joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4657f0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x504810
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x5732cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
push 0x468ad0
call fcn.004dbbc8
add esp, 4
call fcn.004294f0
mov ecx, eax
call fcn.0048eb50
test al, al
jne 0x46584b
cmp dword [esi + 8], 0
je 0x465965
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00441cb0
mov byte [ebp - 4], 1
mov ecx, esi
call fcn.004653f0
test al, al
je 0x465950
mov ecx, esi
call fcn.00464df0
test al, al
je 0x465950
call fcn.00431060
mov ecx, eax
call fcn.004446f0
push 0x5422ee
lea ecx, [ebp - 0x14]
call fcn.0041ad50
mov bl, 2
mov byte [ebp - 4], bl
call fcn.004294f0
mov ecx, eax
call fcn.0048eb50
test al, al
je 0x4658d1
lea ecx, [ebp - 0x18]
push ecx
call fcn.004294f0
mov ecx, eax
call fcn.0048f870
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x14]
call fcn.0041e3d0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x18]
call fcn.00416630
jmp 0x4658f3
cmp dword [esi + 8], 0
je 0x465979
lea eax, [esi + 0xc]
mov edx, dword [eax]
cmp dword [edx - 8], 1
jle 0x465979
push eax
lea ecx, [ebp - 0x14]
call fcn.0041e3d0
push 0x514670
lea ecx, [ebp - 0x14]
call fcn.0041d470
push str.ewallet.dat
lea ecx, [ebp - 0x14]
call fcn.0041d470
push 0x5422ee
lea ecx, [ebp - 0x18]
call fcn.0041ad50
mov byte [ebp - 4], 4
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.00464f60
push 0
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x18]
call fcn.00416630
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00416630
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0
je 0x465965
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00416630
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0
je 0x465965
mov eax, dword [eax]
push eax
jmp 0x46595f
Function at 0x4668c0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5049e0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x5732cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
push 0x468ad0
call fcn.004dbbc8
add esp, 4
mov byte [ebp - 0x11], 0
call fcn.004294f0
mov ecx, eax
call fcn.0048eb50
test al, al
jne 0x46692f
cmp dword [esi + 8], 0
jne 0x46692f
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00441cb0
mov ebx, 1
mov byte [ebp - 4], bl
mov ecx, esi
call fcn.00465240
test al, al
je 0x466996
push 0x5422ee
lea ecx, [ebp - 0x18]
call fcn.0041ad50
mov byte [ebp - 4], 2
push ebx
lea ecx, [ebp - 0x18]
push ecx
mov ecx, esi
call fcn.00465f50
push 0
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x466988
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x46698b
mov byte [ebp - 0x11], bl
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x18]
call fcn.00416630
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0
je 0x4669ab
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x466a80
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x504a10
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5732cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
push 0x468ad0
call fcn.004dbbc8
add esp, 4
call fcn.004294f0
mov ecx, eax
call fcn.0048eb50
test al, al
jne 0x466ad7
cmp dword [esi + 8], 0
je 0x466b52
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x18]
call fcn.00441cb0
mov ebx, 1
mov byte [ebp - 4], bl
push 0x5422ee
lea ecx, [ebp - 0x14]
call fcn.0041ad50
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
push ecx
mov ecx, esi
call fcn.00466280
test al, al
je 0x466b32
push str..bkup
lea ecx, [ebp - 0x14]
call fcn.0041d470
push ebx
push 0
mov esi, dword [ebp - 0x14]
push esi
call fcn.0046dc30
add esp, 0xc
test al, al
je 0x466b32
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.00416630
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
je 0x466b52
mov edx, dword [eax]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x466c20
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x504a40
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5732cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
push 0x468ad0
call fcn.004dbbc8
add esp, 4
call fcn.004294f0
mov ecx, eax
call fcn.0048eb50
test al, al
jne 0x466c77
cmp dword [esi + 8], 0
je 0x466cf2
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x18]
call fcn.00441cb0
mov ebx, 1
mov byte [ebp - 4], bl
push 0x5422ee
lea ecx, [ebp - 0x14]
call fcn.0041ad50
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
push ecx
mov ecx, esi
call fcn.004663f0
test al, al
je 0x466cd2
push str..bkup
lea ecx, [ebp - 0x14]
call fcn.0041d470
push ebx
push 0
mov esi, dword [ebp - 0x14]
push esi
call fcn.0046dc30
add esp, 0xc
test al, al
je 0x466cd2
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.00416630
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
je 0x466cf2
mov edx, dword [eax]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x466dc0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x504a78
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x5732cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
push 0x468ad0
call fcn.004dbbc8
add esp, 4
call fcn.004294f0
mov ecx, eax
call fcn.0048eb50
test al, al
jne 0x466e1b
cmp dword [esi + 8], 0
je 0x466f30
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00441cb0
mov ebx, 1
mov byte [ebp - 4], bl
push 0x5422ee
lea ecx, [ebp - 0x18]
call fcn.0041ad50
mov byte [ebp - 4], 2
push 0x5422ee
lea ecx, [ebp - 0x14]
call fcn.0041ad50
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
push ecx
mov ecx, esi
call fcn.00466280
test al, al
je 0x466f04
mov esi, dword [ebp - 0x18]
push esi
mov edx, dword [esi - 8]
push edx
lea ecx, [ebp - 0x14]
call fcn.0041ce60
push str..bkup
lea ecx, [ebp - 0x14]
call fcn.0041d470
push ebx
push 0
cmp byte [ebp + 8], 0
je 0x466ec5
push esi
call fcn.0046dc30
add esp, 0xc
test al, al
je 0x466f04
push ebx
push 0
mov edi, dword [ebp - 0x14]
push edi
call fcn.0046dc30
add esp, 0xc
test al, al
je 0x466eb1
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
push 0
push edi
call fcn.0046dc30
add esp, 0xc
test al, al
jne 0x466f04
push edi
push esi
jmp 0x466efe
mov edi, dword [ebp - 0x14]
push edi
call fcn.0046dc30
add esp, 0xc
test al, al
je 0x466f04
push ebx
push 0
push esi
call fcn.0046dc30
add esp, 0xc
test al, al
je 0x466eec
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
push 0
push esi
call fcn.0046dc30
add esp, 0xc
test al, al
jne 0x466f04
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.00416630
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x18]
call fcn.00416630
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0
je 0x466f30
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x467000
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x504ab8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x5732cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
push 0x468ad0
call fcn.004dbbc8
add esp, 4
call fcn.004294f0
mov ecx, eax
call fcn.0048eb50
test al, al
jne 0x46705b
cmp dword [esi + 8], 0
je 0x467170
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00441cb0
mov ebx, 1
mov byte [ebp - 4], bl
push 0x5422ee
lea ecx, [ebp - 0x18]
call fcn.0041ad50
mov byte [ebp - 4], 2
push 0x5422ee
lea ecx, [ebp - 0x14]
call fcn.0041ad50
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
push ecx
mov ecx, esi
call fcn.004663f0
test al, al
je 0x467144
mov esi, dword [ebp - 0x18]
push esi
mov edx, dword [esi - 8]
push edx
lea ecx, [ebp - 0x14]
call fcn.0041ce60
push str..bkup
lea ecx, [ebp - 0x14]
call fcn.0041d470
push ebx
push 0
cmp byte [ebp + 8], 0
je 0x467105
push esi
call fcn.0046dc30
add esp, 0xc
test al, al
je 0x467144
push ebx
push 0
mov edi, dword [ebp - 0x14]
push edi
call fcn.0046dc30
add esp, 0xc
test al, al
je 0x4670f1
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
push 0
push edi
call fcn.0046dc30
add esp, 0xc
test al, al
jne 0x467144
push edi
push esi
jmp 0x46713e
mov edi, dword [ebp - 0x14]
push edi
call fcn.0046dc30
add esp, 0xc
test al, al
je 0x467144
push ebx
push 0
push esi
call fcn.0046dc30
add esp, 0xc
test al, al
je 0x46712c
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
push 0
push esi
call fcn.0046dc30
add esp, 0xc
test al, al
jne 0x467144
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.00416630
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x18]
call fcn.00416630
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0
je 0x467170
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x468b60
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x5732cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x230], 0x224
push 0x220
push 0
lea eax, [ebp - 0x22c]
push eax
call fcn.004dba80
add esp, 0xc
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
push 0
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xffffffff
je 0x468c13
lea edx, [ebp - 0x230]
push edx
mov eax, dword [ebp - 0x234]
push eax
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x468c13
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x21c]
cmp ecx, dword [ebp - 0x218]
jae 0x468bfc
push 0x104
lea edx, [ebp - 0x110]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x21c]
mov dword [ecx], edx
jmp 0x468c13
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x234]
push ecx
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x468bc8
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
movsx eax, byte [eax]
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004db901
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46a840
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x505088
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0xd4
mov eax, dword [0x5732cc]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
push 0x468ad0
call fcn.004dbbc8
add esp, 4
lea ecx, [ebp - 0x14]
call fcn.00417420
mov byte [ebp - 4], 1
push 0x94
push 0
lea eax, [ebp - 0xb0]
push eax
call fcn.004dba80
add esp, 0xc
mov dword [ebp - 0xb0], 0x94
lea ecx, [ebp - 0xb0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x46aa7c
cmp dword [ebp - 0xa0], 1
jne 0x46a908
cmp dword [ebp - 0xac], 4
jne 0x46a908
cmp dword [ebp - 0xa8], 0xa
jne 0x46a908
mov dword [ebp - 0xbc], 0x51c3cc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00416630
mov eax, dword [ebp - 0xbc]
jmp 0x46abee
cmp dword [ebp - 0xa0], 2
jne 0x46a949
cmp dword [ebp - 0xac], 5
jne 0x46a949
cmp dword [ebp - 0xa8], 0
jne 0x46a949
mov dword [ebp - 0xc0], str.Win2000
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00416630
mov eax, dword [ebp - 0xc0]
jmp 0x46abee
cmp dword [ebp - 0xa0], 2
jne 0x46a98a
cmp dword [ebp - 0xac], 5
jne 0x46a98a
cmp dword [ebp - 0xa8], 1
jne 0x46a98a
mov dword [ebp - 0xc4], str.WinXP
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00416630
mov eax, dword [ebp - 0xc4]
jmp 0x46abee
cmp dword [ebp - 0xa0], 2
jne 0x46a9cb
cmp dword [ebp - 0xac], 5
jne 0x46a9cb
cmp dword [ebp - 0xa8], 2
jne 0x46a9cb
mov dword [ebp - 0xc8], str.Win2003
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00416630
mov eax, dword [ebp - 0xc8]
jmp 0x46abee
cmp dword [ebp - 0xa0], 2
jne 0x46aa7c
cmp dword [ebp - 0xac], 6
jne 0x46aa7c
cmp dword [ebp - 0xa8], 0
je 0x46a9fb
cmp dword [ebp - 0xa8], 1
jne 0x46aa7c
movzx edx, byte [ebp + 8]
test edx, edx
jne 0x46aa26
mov dword [ebp - 0xcc], 0x51c3ec
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00416630
mov eax, dword [ebp - 0xcc]
jmp 0x46abee
cmp dword [ebp - 0xa8], 0
jne 0x46aa52
mov dword [ebp - 0xd0], 0x51c3f4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00416630
mov eax, dword [ebp - 0xd0]
jmp 0x46abee
cmp dword [ebp - 0xa8], 1
jne 0x46aa7c
mov dword [ebp - 0xd4], str.Win7
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00416630
mov eax, dword [ebp - 0xd4]
jmp 0x46abee
mov dword [ebp - 0xd8], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00416630
mov eax, dword [ebp - 0xd8]
jmp 0x46abee
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.004db901
mov esp, ebp
pop ebp
ret
Function at 0x46b370
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5051d0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5732cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], 4
movzx eax, byte [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x18]
push ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0x51c5fc
mov ecx, 0x5771d8
call fcn.00415d40
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x51c618
call fcn.0041ad50
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
call fcn.0046a780
add esp, 4
mov byte [ebp - 0x29], al
movzx edx, byte [ebp - 0x29]
test edx, edx
je 0x46b45b
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
push 0x51c620
lea eax, [ebp - 0x20]
push eax
call fcn.0046b160
add esp, 4
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x34]
call fcn.00415d40
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00416630
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x46b470
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x505200
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5732cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], 4
mov byte [ebp - 0x1d], 0
push 0
call fcn.0046a840
add esp, 4
push eax
lea ecx, [ebp - 0x10]
call fcn.0041ad50
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push 0x51c63c
call fcn.00422290
movzx ecx, al
test ecx, ecx
je 0x46b53d
lea ecx, [ebp - 0x24]
call fcn.00417420
mov byte [ebp - 4], 1
lea edx, [ebp - 0x24]
push edx
call fcn.0046ba20
add esp, 4
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0x51c644
lea ecx, [ebp - 0x24]
call fcn.00415d40
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x46b52f
mov dword [ebp - 0x1c], 1
push 1
call fcn.0046b370
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.00416630
jmp 0x46b579
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x14]
push edx
push str.EnableExceptionHandlingFlag
mov ecx, 0x5771d8
call fcn.00415d40
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x46b579
mov dword [ebp - 0x1c], 1
push 1
call fcn.0046b370
add esp, 4
xor eax, eax
cmp eax, dword [ebp - 0x1c]
sbb ecx, ecx
neg ecx
mov byte [ebp - 0x1d], cl
mov dl, byte [ebp - 0x1d]
mov byte [ebp - 0x25], dl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00416630
mov al, byte [ebp - 0x25]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x46bb00
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5052a1
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5732cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x10]
call fcn.00417420
mov dword [ebp - 4], 1
cmp dword [ebp + 0xc], 0
je 0x46bc37
mov eax, dword [ebp + 0xc]
movsx ecx, byte [eax]
test ecx, ecx
je 0x46bc37
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 0xc]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jbe 0x46bc37
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.004dbafa
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x46bc37
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x46bc2b
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x20]
push ecx
push 0x51c758
mov edx, dword [ebp - 0x1c]
push edx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x46bc2b
cmp dword [ebp - 0x20], 0
je 0x46bc2b
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0xc]
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 8]
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 8]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
push edx
push str._d._d._d._d
lea eax, [ebp - 0x10]
push eax
call fcn.0042a780
add esp, 0x18
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.004dbb8e
add esp, 4
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp + 8]
call fcn.0041ea10
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00416630
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x46bc70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5051d0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5732cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], 4
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x51c7ec
call fcn.0041ad50
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
call fcn.0046a780
add esp, 4
mov byte [ebp - 0x29], al
movzx ecx, byte [ebp - 0x29]
test ecx, ecx
je 0x46bd36
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0x51c7f4
lea edx, [ebp - 0x20]
push edx
call fcn.0046b160
add esp, 4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x34]
call fcn.00415d40
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00416630
jmp 0x46bd5d
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x10]
push eax
push str.MaxDump
mov ecx, 0x5771d8
call fcn.00415d40
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x46be80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x505341
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x140
mov eax, dword [0x5732cc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
push 0x468ad0
call fcn.004dbbc8
add esp, 4
mov dword [ebp - 0x12c], reloc.WS2_32.dll_accept
push 0x5771d8
lea ecx, [ebp - 0x134]
call fcn.0041ea10
mov byte [ebp - 4], 1
push 0x51c804
lea ecx, [ebp - 0x130]
call fcn.0041ad50
mov byte [ebp - 4], 2
mov dword [ebp - 0x124], 1
mov dword [ebp - 0x128], 0
mov ecx, dword [ebp + 8]
call fcn.0042d080
lea eax, [ebp - 0x128]
push eax
push 0
lea ecx, [ebp - 0x124]
push ecx
push 0x51c80c
mov ecx, 0x5771d8
call fcn.00415d40
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
cmp dword [ebp - 0x128], 0
jbe 0x46c04f
mov edx, dword [ebp - 0x128]
push edx
call fcn.004da8e1
add esp, 4
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x138], eax
mov ecx, dword [ebp - 0x128]
push ecx
push 0
mov edx, dword [ebp - 0x138]
push edx
call fcn.004dba80
add esp, 0xc
lea eax, [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0x138]
push ecx
lea edx, [ebp - 0x124]
push edx
push 0x51c814
mov ecx, 0x5771d8
call fcn.00415d40
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov eax, dword [ebp - 0x138]
push eax
lea ecx, [ebp - 0x120]
call fcn.00431390
mov dword [ebp - 0x14c], eax
mov ecx, dword [ebp - 0x14c]
mov dword [ebp - 0x150], ecx
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x150]
call fcn.00415d40
push eax
mov ecx, dword [ebp + 8]
call fcn.00450de0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x120]
call fcn.00424870
mov ecx, 0x577200
call fcn.00415d40
push eax
mov ecx, dword [ebp + 8]
call fcn.00424680
test eax, eax
je 0x46c01c
call fcn.0046c190
push 0x577200
mov ecx, dword [ebp + 8]
call fcn.0041e3d0
cmp dword [ebp - 0x138], 0
je 0x46c04d
mov edx, dword [ebp - 0x138]
mov dword [ebp - 0x148], edx
mov eax, dword [ebp - 0x148]
push eax
call fcn.004db440
add esp, 4
jmp 0x46c061
call fcn.0046c190
push 0x577200
mov ecx, dword [ebp + 8]
call fcn.0041e3d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x130]
call fcn.00416630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x134]
call fcn.00416630
jmp 0x46c16c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004db901
mov esp, ebp
pop ebp
ret