joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44754c
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4475ea
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xc]
je 0x4475ae
cmp byte [ebx + 0x10], 0
jne 0x4475ae
cmp byte [ebx + 0x3c], 0
jne 0x4475ae
mov byte [ebx + 0xe], 0
mov byte [ebx + 0xc], 0
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4475cf
lea edx, [ebp - 4]
mov eax, dword [0x4b5e28]
call fcn.0040a52c
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x439670]
call fcn.00421e0c
call fcn.004061a0
jmp 0x4475cf
lea edx, [ebp - 8]
mov eax, dword [0x4b5e28]
call fcn.0040a52c
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x439670]
call fcn.00421e0c
call fcn.004061a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4475f1
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406b88
ret

Function at 0x447908
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xe]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x447956
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.00447484
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44796f
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x447978
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.00447484
dec esi
jne 0x44799a
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x44d2a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x44d33c
push 0
mov eax, ebx
call fcn.0040774c
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
test ebx, ebx
jne 0x44d317
mov ebx, esi
test ebx, ebx
je 0x44d2e9
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.0040774c
push eax
push 1
push 0
mov eax, edi
call fcn.0040774c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x44d332
mov ecx, dword [0x4b5c58]
mov dl, 1
mov eax, dword [0x44b708]
call fcn.00421ec8
call fcn.004061a0
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x44d358
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, ebx
call fcn.00406b28
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, esi
call fcn.0040774c
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x44d414
xor eax, eax
push ebp
push 0x44d40d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004078d0
mov eax, dword [ebp - 8]
add eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.0040774c
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040774c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x44d3ef
mov edx, dword [ebp - 8]
shr edx, 1
dec edx
mov eax, ebx
call fcn.004078d0
jmp 0x44d3f6
mov eax, ebx
call fcn.00406b28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d414
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x450790
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x4507e2
test eax, edx
je 0x4507e5
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x4507a5
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x4507cb
add ecx, 4
js 0x4507bb
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x4507c8
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x4507f1
test edx, edx
jne 0x450798
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret
Function at 0x455ed0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebx + 4]
call fcn.0040774c
push eax
push 0x800
lea eax, [ebp - 0x1000]
push eax
mov eax, dword [ebp + 0xc]
call fcn.0040774c
push eax
mov eax, edi
call fcn.0040774c
push eax
mov eax, esi
call fcn.0040774c
push eax
call sub.kernel32.dll_GetPrivateProfileStringW
mov ecx, eax
lea edx, [ebp - 0x1000]
mov eax, dword [ebp + 8]
call fcn.00406cb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x456a94
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x456b6a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor esi, esi
push ebp
push 0x456b3d
push dword fs:[esi]
mov dword fs:[esi], esp
test dl, dl
je 0x456aee
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00407848
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0041b6d4
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, 0xfde9
call fcn.004072b8
jmp 0x456afd
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0xfde9
call fcn.00407404
mov eax, 1
mov edx, dword [ebp - 4]
test edx, edx
je 0x456b0e
sub edx, 4
mov edx, dword [edx]
test edx, edx
jle 0x456b30
mov ecx, 1
imul eax, eax, 0x5517e877
mov ebx, dword [ebp - 4]
movzx ebx, byte [ebx + ecx - 1]
xor eax, dword [ebx*4 + 0x4b4e3c]
inc ecx
dec edx
jne 0x456b17
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x456b47
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456b71
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00406be8
lea eax, [ebp - 4]
call fcn.00406b4c
ret
Function at 0x459bdc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00406c0c
mov eax, dword [ebp - 8]
call fcn.00406c0c
xor eax, eax
push ebp
push 0x459cef
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor ebx, ebx
mov eax, dword [0x4b5b5c]
cmp byte [eax], 0
je 0x459c42
call fcn.0040a830
cmp byte [eax + 0x15], 0
je 0x459c2f
mov ebx, pe_nt_image_headers32
jmp 0x459c42
call fcn.0040a830
cmp byte [eax + 0x14], 0
je 0x459c42
mov ebx, 0x200
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
or ebx, 0x20006
push ebx
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040774c
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
push ebx
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x459cd4
cmp dword [ebp - 8], 0
jne 0x459c9d
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
test ebx, ebx
sete byte [ebp - 9]
jmp 0x459cc5
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.0040774c
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
test ebx, ebx
sete byte [ebp - 9]
push ebx
call sub.kernel32.dll_SetLastError
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459cf6
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406b88
ret
Function at 0x459d04
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00406c0c
mov eax, dword [ebp - 8]
call fcn.00406c0c
xor eax, eax
push ebp
push 0x459e44
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [edi], eax
xor ebx, ebx
mov eax, dword [0x4b5b5c]
cmp byte [eax], 0
je 0x459d7a
call fcn.0040a830
cmp byte [eax + 0x15], 0
je 0x459d67
mov ebx, pe_nt_image_headers32
jmp 0x459d7a
call fcn.0040a830
cmp byte [eax + 0x14], 0
je 0x459d7a
mov ebx, 0x200
lea eax, [ebp - 0x18]
push eax
or ebx, 0x20019
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.0040774c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x459e29
cmp dword [ebp - 8], 0
jne 0x459dab
xor ebx, ebx
jmp 0x459db5
mov eax, dword [ebp - 8]
call fcn.0040774c
mov ebx, eax
lea eax, [ebp - 0x20]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x459e20
mov eax, dword [ebp - 0x20]
call fcn.004044d8
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x459e18
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x459e0e
mov eax, dword [ebp - 0x1c]
mov dword [esi], eax
mov eax, dword [ebp - 0x20]
mov dword [edi], eax
mov byte [ebp - 0xd], 1
jmp 0x459e20
mov eax, dword [ebp - 0x1c]
call fcn.004044f4
jmp 0x459e20
mov eax, dword [ebp - 0x1c]
call fcn.004044f4
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459e4b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406b88
ret

Function at 0x45a12c
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, ecx
mov edi, edx
mov esi, eax
mov byte [esp], 0
xor ebx, ebx
mov eax, dword [0x4b5b5c]
cmp byte [eax], 0
je 0x45a171
call fcn.0040a830
cmp byte [eax + 0x15], 0
je 0x45a15e
mov ebx, pe_nt_image_headers32
jmp 0x45a171
call fcn.0040a830
cmp byte [eax + 0x14], 0
je 0x45a171
mov ebx, 0x200
lea eax, [esp + 4]
push eax
or ebx, 0x20006
push ebx
push 0
mov eax, edi
call fcn.0040774c
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
mov ebx, eax
push ebx
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x45a1bb
mov eax, ebp
call fcn.0040774c
push eax
mov eax, dword [esp + 8]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete byte [esp]
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
movzx eax, byte [esp]
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x45a1c8
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [0x4b5b5c]
cmp byte [eax], 0
jne 0x45a1fa
mov eax, dword [ebp - 8]
call fcn.0040774c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov ebx, eax
jmp 0x45a27b
xor eax, eax
push ebp
push 0x45a25d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [0x4b5b5c]
cmp byte [eax], 0
je 0x45a23c
call fcn.0040a830
cmp byte [eax + 0x15], 0
je 0x45a229
mov ebx, pe_nt_image_headers32
jmp 0x45a23c
call fcn.0040a830
cmp byte [eax + 0x14], 0
je 0x45a23c
mov ebx, 0x200
push 0
push ebx
mov eax, dword [ebp - 8]
call fcn.0040774c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45a27b
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x45a398
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 0x11], cl
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x45a588
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 0x10]
mov eax, 0x45a5a4
call fcn.00407cc4
test eax, eax
je 0x45a565
cmp byte [ebp - 0x11], 0
je 0x45a558
xor edx, edx
push ebp
push 0x45a54e
push dword fs:[edx]
mov dword fs:[edx], esp
xor esi, esi
mov eax, dword [0x4b5b5c]
cmp byte [eax], 0
je 0x45a426
call fcn.0040a830
cmp byte [eax + 0x15], 0
je 0x45a413
mov esi, pe_nt_image_headers32
jmp 0x45a426
call fcn.0040a830
cmp byte [eax + 0x14], 0
je 0x45a426
mov esi, 0x200
lea eax, [ebp - 0x18]
push eax
or esi, 0x2000f
push esi
push 0
mov eax, dword [ebp - 0x10]
call fcn.0040774c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
xor edx, edx
push ebp
push 0x45a53d
push dword fs:[edx]
mov dword fs:[edx], esp
test eax, eax
jne 0x45a51c
xor eax, eax
mov dword [ebp - 0x20], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryInfoKeyW
test eax, eax
jne 0x45a51c
mov esi, dword [ebp - 0x20]
dec esi
cmp esi, 0
jl 0x45a51c
mov eax, dword [0x4b52a4]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x1c]
call fcn.004078d0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
call fcn.004070dc
push eax
push esi
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x45a512
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x1c]
call fcn.004078d0
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x10]
call fcn.00422f2c
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
call fcn.004079a8
movzx ecx, byte [ebp - 0x11]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0045a398
test al, al
jne 0x45a512
call fcn.00406294
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45a565
dec esi
cmp esi, 0xffffffff
jne 0x45a496
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a544
lea eax, [ebp - 4]
xor edx, edx
call fcn.004078d0
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0045a284
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a58f
lea eax, [ebp - 0x24]
call fcn.00406b28
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406b88
ret
Function at 0x45a8d8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov byte [ebp - 1], 6
xor edx, edx
push ebp
push 0x45a9bb
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call sub.kernel32.dll_GetVersionExW
mov eax, dword [ebp - 0x110]
cmp eax, 2
jne 0x45a976
mov byte [ebp - 1], 4
mov eax, dword [ebp - 0x11c]
cmp eax, 6
jb 0x45a952
mov byte [ebp - 1], 9
cmp byte [ebp - 6], 1
jne 0x45a93f
cmp dword [ebp - 0x118], 1
jb 0x45a9b1
mov byte [ebp - 1], 0xc
jmp 0x45a9b1
mov byte [ebp - 1], 0xa
cmp dword [ebp - 0x118], 1
jb 0x45a9b1
mov byte [ebp - 1], 0xb
jmp 0x45a9b1
cmp eax, 5
jb 0x45a9b1
mov byte [ebp - 1], 5
cmp dword [ebp - 0x118], 1
jb 0x45a9b1
cmp byte [ebp - 6], 1
jne 0x45a970
mov byte [ebp - 1], 6
jmp 0x45a9b1
mov byte [ebp - 1], 8
jmp 0x45a9b1
cmp eax, 1
jne 0x45a9ad
mov byte [ebp - 1], 0
cmp dword [ebp - 0x11c], 4
jne 0x45a995
cmp dword [ebp - 0x118], 0xa
jne 0x45a995
mov byte [ebp - 1], 1
cmp dword [ebp - 0x11c], 4
jne 0x45a9b1
cmp dword [ebp - 0x118], 0x5a
jne 0x45a9b1
mov byte [ebp - 1], 2
jmp 0x45a9b1
mov byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45a9c5
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45b328
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406c0c
xor eax, eax
push ebp
push 0x45b487
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00406b28
mov edx, dword [ebp - 4]
mov eax, 0x45b4a4
call fcn.00407cc4
test eax, eax
jne 0x45b3f7
lea eax, [ebp - 8]
mov edx, 1
call fcn.004078d0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040774c
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040774c
mov edi, eax
push edi
push 0
call sub.kernel32.dll_SearchPathW
mov ebx, eax
inc ebx
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004078d0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040774c
push eax
push ebx
push 0
push edi
push 0
call sub.kernel32.dll_SearchPathW
test eax, eax
je 0x45b3eb
mov eax, dword [ebp - 8]
call fcn.0040774c
call fcn.00407040
lea edx, [ebp - 8]
xchg edx, eax
call fcn.004078d0
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.00406f08
jmp 0x45b46c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00406f08
jmp 0x45b46c
lea eax, [ebp - 8]
mov edx, 1
call fcn.004078d0
push 0
mov eax, dword [ebp - 8]
call fcn.0040774c
push eax
mov eax, dword [ebp - 4]
call fcn.0040774c
mov edi, eax
push edi
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov ebx, eax
inc ebx
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004078d0
push ebx
mov eax, dword [ebp - 8]
call fcn.0040774c
push eax
push edi
call sub.kernel32.dll_ExpandEnvironmentStringsW
test eax, eax
je 0x45b462
mov eax, dword [ebp - 8]
call fcn.0040774c
call fcn.00407040
lea edx, [ebp - 8]
xchg edx, eax
call fcn.004078d0
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.00406f08
jmp 0x45b46c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00406f08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b48e
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406b88
ret

Function at 0x45b960
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45ba2f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00406b28
xor edx, edx
push ebp
push 0x45ba0c
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xff
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
test eax, eax
je 0x45ba02
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.004077a4
mov eax, dword [ebx]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
test eax, eax
je 0x45b9d2
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x45b9e8
mov eax, ebx
mov edx, 0x45ba4c
call fcn.00407950
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0045b910
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00406f08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45ba16
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ba36
lea eax, [ebp - 0x208]
call fcn.00406b28
ret
Function at 0x45ba50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov dword [ebp - 0x204], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45bb44
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00406b28
xor edx, edx
push ebp
push 0x45bb1c
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x200]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathW
test eax, eax
je 0x45bb12
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.004077a4
lea edx, [ebp - 0x204]
mov eax, dword [ebx]
call fcn.0045cc00
mov edx, dword [ebp - 0x204]
mov eax, ebx
call fcn.00406f08
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0045b910
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00406f08
mov eax, dword [ebx]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
test eax, eax
je 0x45bafc
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x45bb12
mov eax, ebx
mov edx, 0x45bb60
call fcn.00407950
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45bb26
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bb4b
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.00406b88
ret
Function at 0x45bb64
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x45bcf8
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x45bccb
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.0045a9d0
cmp al, 9
jb 0x45bc43
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.004078d0
xor edx, edx
push ebp
push 0x45bc3c
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.0040774c
push eax
push 0
push 0
push 0x1a
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x45bc24
mov eax, dword [ebp - 4]
call fcn.0040774c
mov edx, dword [ebp - 8]
call fcn.0041d730
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x45bbf6
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x45bc12
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00422f2c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00406f08
call fcn.00406294
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45bcd5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bc43
lea eax, [ebp - 4]
xor edx, edx
call fcn.004078d0
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x4b5ce4]
mov eax, dword [eax]
mov ecx, 0x45bd14
mov edx, 0x45bd30
call fcn.00459f40
test al, al
je 0x45bcc1
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0045b910
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00406f08
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x45bc8f
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x45bcc1
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x45bca4
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x45bcc1
mov eax, dword [ebp - 8]
mov edx, 0x45bdc0
call fcn.00407950
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45bcd5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bcff
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00406b88
lea eax, [ebp - 4]
call fcn.00406b28
ret