joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408f9d
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0x230
mov eax, 0x43d56d
call fcn.0043a128
xor ebx, ebx
mov dword [ebp - 0x21c], ebx
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
mov dword [ebp - 0x220], edi
mov word [edi + 4], bx
push 0x208
xor esi, esi
lea eax, [ebp - 0x218]
push ebx
mov dword [ebp - 4], ebx
inc esi
push eax
mov dword [ebp - 0x21c], esi
call fcn.0041ef10
mov al, byte [ebp + 8]
add esp, 0xc
neg al
push esi
sbb eax, eax
and eax, 0xfffffff7
add eax, 0x23
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40906d
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x23c]
call fcn.00409482
push 0xffffffffffffffff
mov dword [ebp - 4], esi
push ebx
mov esi, edi
call fcn.004098f5
push ebx
push 1
lea esi, [ebp - 0x23c]
mov byte [ebp - 4], bl
call fcn.00409826
cmp byte [ebp + 8], bl
je 0x409045
push str.TencentDeskUpdate
jmp 0x40904a
push str.TencentDesktop
push edi
call fcn.004094c7
mov ecx, edi
call fcn.00409075
test al, al
jne 0x409062
mov ecx, edi
call fcn.00409141
push str.Global.db
push edi
call fcn.004094c7
mov eax, edi
call fcn.0043a1ab
ret

Function at 0x409ebd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp edi, ebx
jne 0x409ed2
push 0x80004005
call fcn.004019c3
push edi
push esi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp esi, ebx
je 0x409f2a
mov ecx, dword [edi]
cmp ecx, ebx
jbe 0x409f27
cmp dword [ebp - 4], ebx
jbe 0x409f24
cmp dword [ebp - 4], 2
jbe 0x409f2f
cmp dword [ebp - 4], 7
jne 0x409f24
test cl, 1
jne 0x409f24
shr ecx, 1
cmp ecx, 1
jb 0x409f24
cmp word [esi + ecx*2 - 2], bx
jne 0x409f24
cmp ecx, 1
jbe 0x409f2a
cmp word [esi + ecx*2 - 4], bx
je 0x409f2a
push 0xd
pop eax
mov word [esi], bx
pop ebx
leave
ret 8
test cl, 1
jne 0x409f24
shr ecx, 1
cmp word [esi + ecx*2 - 2], bx
jmp 0x409f22

Function at 0x409f60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x409f73
push 0x80004005
call fcn.004019c3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
add eax, eax
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push 1
push 0
push dword [ebp + 0x10]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop ebp
ret 0xc
Function at 0x417971
Capabilities:
Check if file exists

Disassembly:
push 0x24
mov eax, 0x43cf48
call fcn.0043a0bf
lea ecx, [ebp - 0x14]
call fcn.004160d8
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
push str.dr.dll
push ecx
mov ecx, eax
call fcn.004038ca
pop ecx
pop ecx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004019ab
push dword [ebp - 0x10]
call fcn.00416022
test eax, eax
pop ecx
jne 0x4179d3
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4179d3
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004019ab
xor al, al
jmp 0x417a10
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x30]
call fcn.00409482
mov byte [ebp - 4], 3
call fcn.0043b1f0
lea ecx, [ebp - 0x30]
mov ebx, eax
call fcn.0043b400
push 0
push 1
lea esi, [ebp - 0x30]
mov edi, eax
call fcn.00409826
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004019ab
cmp edi, 1
sete al
call fcn.0043a197
ret

Function at 0x417a16
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43e4e0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x44b074]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
lea ecx, [esp + 0x10]
call fcn.004160d8
and dword [esp + 0x20], 0
lea ecx, [esp + 0xc]
push str.dr.dll
push ecx
mov ecx, eax
call fcn.004038ca
pop ecx
pop ecx
mov byte [esp + 0x20], 2
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
call fcn.004019ab
mov esi, dword [0x44e24c]
call fcn.0043b1f0
and dword [eax + 4], 0
push 0x44e248
mov dword [eax], 0x3f5
mov dword [eax + 0x10], esi
call fcn.0043b1f0
mov edi, eax
call fcn.00419bde
call fcn.0043b1f0
mov edi, eax
call fcn.0043b390
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
call fcn.004019ab
xor eax, eax
inc eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43d934
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x4b6c04]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x14], eax
push ecx
mov esi, 0x104
mov dword [eax], edi
mov edx, esi
mov dword [eax + 4], edi
lea ecx, [esp + 0x1c]
call fcn.0043c80d
push 0x415018
mov edx, esi
lea ecx, [esp + 0x1c]
call fcn.0043c842
lea eax, [esp + 0x18]
push eax
push edi
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov esi, eax
test esi, esi
jne 0x43d9ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x43d9f0
mov ecx, dword [ebp + 4]
mov edx, 0xc8
push 0x414fd0
call fcn.0043d6c0
mov edi, eax
jmp 0x43d9f0
lea edx, [esp + 0x10]
mov dword [esp + 0x10], edi
mov ecx, esi
call fcn.0043d819
mov ebx, eax
test ebx, ebx
jns 0x43d9e2
push ebx
push ecx
mov ecx, dword [ebp + 4]
mov edx, 0xce
call fcn.0043d6a1
mov edi, ebx
jmp 0x43d9f0
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
test esi, esi
je 0x43d9fa
push esi
call fcn.0043d71c
mov ecx, dword [esp + 0x224]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a4e80
mov esp, ebp
pop ebp
ret 8
Function at 0x453e35
Capabilities:
Delete file

Disassembly:
push 0x18
mov eax, 0x4a821d
call fcn.004a53f6
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], esi
call dword [0x4b936c]
mov byte [ebp - 4], 1
cmp dword [edi + 0xf0], esi
jne 0x453e6a
mov esi, 0x80070057
jmp 0x453f5b
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x1c]
lea eax, [ebx + 0xd4]
push eax
call dword [sym.imp.MFC42u.dll_CString::CString_1]
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x1c]
cmp dword [eax - 8], esi
jne 0x453e93
mov esi, 0x80004001
jmp 0x453f52
mov eax, dword [edi + 0xb8]
lea edx, [ebp - 0x1c]
add eax, 0x5c
lea ecx, [ebp - 0x20]
push eax
call fcn.00450409
mov esi, eax
test esi, esi
jne 0x453f52
push dword [ebp - 0x20]
lea ecx, [ebp - 0x14]
call dword [0x4b9374]
push dword [ebp - 0x20]
call sub.msvcrt.dll_free
pop ecx
lea eax, [ebp - 0x18]
push eax
push 0x12
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_SHCreateStreamOnFileW]
mov esi, eax
test esi, esi
jne 0x453f52
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
call fcn.00452f31
mov edx, eax
mov ecx, ebx
lea eax, [ebp - 0x20]
push eax
call fcn.00452f70
test edx, edx
jne 0x453f01
test eax, eax
jne 0x453f01
lea eax, [ebp - 0x24]
jmp 0x453f03
xor eax, eax
mov ecx, dword [edi + 0xb8]
mov edx, dword [edi + 0xf4]
push eax
push dword [ebp - 0x18]
mov ecx, dword [ecx + 0x60]
push 1
call fcn.0048b4cd
xor edx, edx
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.0044761a
mov eax, dword [ebp - 0x14]
cmp dword [eax - 8], 0
je 0x453f39
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test esi, esi
jne 0x453f52
test byte [0x4b7fc0], 4
je 0x453f50
mov edx, 0x4152b0
call fcn.00445f12
xor esi, esi
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MFC42u.dll_CString::CString]
lea ecx, [ebp - 0x14]
call dword [sym.imp.MFC42u.dll_CString::CString]
lea ecx, [ebp - 0x18]
call fcn.00444adb
mov eax, esi
call fcn.004a53c4
ret 4
Function at 0x465423
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x4b6c04]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push edx
call dword [sym.imp.MFC42u.dll_CDataExchange::PrepareEditCtrl]
cmp dword [ebx], 0
mov edi, eax
je 0x4654b5
push 0x40
lea eax, [ebp - 0x8c]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [ebp - 0x8c], 0
je 0x4654ad
push esi
lea eax, [ebp - 0x8c]
push eax
call fcn.0047a0f3
test eax, eax
jne 0x46548d
push 0xffffffffffffffff
push 0x40
push 0x67
call dword [sym.imp.MFC42u.dll_AfxMessageBox]
mov ecx, ebx
call dword [sym.imp.MFC42u.dll_CDataExchange::Fail]
push ecx
push dword [esi]
lea eax, [ebp - 0x8c]
push 0x40
push eax
call fcn.0047a20d
push esi
lea eax, [ebp - 0x8c]
push eax
call fcn.0047a0f3
jmp 0x4654dc
mov dword [esi], SysReAllocString
jmp 0x4654dc
cmp dword [esi], 0x7fffffff
je 0x4654dc
push ecx
push dword [esi]
lea eax, [ebp - 0x8c]
push 0x40
push eax
call fcn.0047a20d
lea eax, [ebp - 0x8c]
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a4e80
mov esp, ebp
pop ebp
ret 4

Function at 0x4659a2
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4b6c04]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4b8710], 0
jne 0x465a80
push ebx
push esi
push edi
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x20c]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov edi, ebx
mov esi, 0x4b7454
cmp dword [esi - 4], ebx
jne 0x465a64
cmp dword [esi], ebx
je 0x465a64
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x465a46
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
je 0x465a46
xor ecx, ecx
mov edx, 0x104
mov word [eax], cx
lea ecx, [ebp - 0x20c]
push dword [esi]
call fcn.0043c842
movzx edi, ax
test edi, edi
jne 0x465a62
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
and edi, 0x10
test edi, edi
jne 0x465a62
mov edx, dword [esi + 4]
lea eax, [ebp - 0x20c]
mov ecx, dword [esi]
push eax
call fcn.0043c80d
movzx edi, ax
test edi, edi
je 0x465a64
mov dword [esi], ebx
add esi, 0x30
cmp esi, 0x4b7724
jl 0x4659e5
pop edi
pop esi
mov dword [0x4b8710], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a4e80
mov esp, ebp
pop ebp
ret
Function at 0x47ba10
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
mov dword [ebp - 8], esi
test ecx, ecx
jne 0x47ba25
xor eax, eax
jmp 0x47ba87
push edi
push esi
push 0x80
push 3
push esi
push 3
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x47ba48
xor eax, eax
jmp 0x47ba86
push esi
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x47ba7d
cmp dword [ebp - 8], 2
jne 0x47ba7d
mov eax, 0xfeff
cmp word [ebp - 4], ax
je 0x47ba7a
mov eax, 0xfffe
cmp word [ebp - 4], ax
jne 0x47ba7d
xor esi, esi
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x47ef50
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x234
mov eax, dword [0x4b6c04]
xor eax, esp
mov dword [esp + 0x230], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x1c], eax
push edi
push edi
push 0xffffffffffffffff
push eax
mov esi, ecx
mov ebx, edi
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
mov ecx, esi
mov dword [esp + 0x10], eax
call fcn.00438717
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push eax
push edi
push 0x434
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esp + 0x10], ebx
jbe 0x47f052
push 0x104
lea eax, [esp + 0x2c]
push eax
push edi
push dword [esp + 0x28]
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0x10
je 0x47f047
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push 0
push 0x437
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], 1
call fcn.004813bc
test eax, eax
je 0x47f023
push 0
push dword [esp + 0x24]
lea eax, [esp + 0x30]
mov ecx, esi
push 0
push 1
push eax
call fcn.004388e4
jmp 0x47f027
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x10], 1
jne 0x47f037
xor ebx, ebx
test eax, eax
sete bl
jmp 0x47f047
test eax, eax
je 0x47f047
lea eax, [esp + 0x28]
mov ecx, esi
push eax
call fcn.0043a0de
inc edi
cmp edi, dword [esp + 0x10]
jb 0x47efb4
lea eax, [esp + 0x14]
push eax
push 0
push 0x437
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x23c]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a4e80
mov esp, ebp
pop ebp
ret 4
Function at 0x481b5b
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
cmp byte [0x4b85dc], 0
push edi
mov edi, ecx
je 0x481bf9
mov eax, dword [ebp + 8]
xor ecx, ecx
push ebx
mov ebx, ecx
cmp dword [eax - 8], ecx
je 0x481bb0
push esi
push ecx
push 0x80
push 3
push ecx
push ecx
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x481baf
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov ecx, dword [0x4b85d4]
xor eax, eax
or ecx, edi
mov dword [0x4b85d8], ebx
lea edi, [ebp - 0xc]
mov dword [0x4b85d4], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
inc eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
push 2
push 0x143c
push 0x4b7278
mov dword [ebp - 4], ebx
call dword [sym.imp.ntdll.dll_WinSqmAddToStream]
mov byte [0x4b85dc], 0
pop ebx
lea ecx, [ebp + 8]
call dword [sym.imp.MFC42u.dll_CString::CString]
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x482d99
Capabilities:
Check if file exists

Disassembly:
push 0xc
mov eax, 0x4aa32c
call fcn.004a5429
mov ebx, ecx
test ebx, ebx
jne 0x482db5
mov edi, 0x80070057
jmp 0x482e7c
xor esi, esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x482e3e
lea eax, [ebp - 0x14]
push eax
push 0x414ddc
push 1
push esi
push 0x414dec
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
js 0x482e43
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x14]
mov ecx, esi
call dword [0x4ba1e0]
call esi
mov edi, eax
test edi, edi
js 0x482e43
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push ecx
push 0x414d6c
push eax
mov esi, dword [eax]
mov ecx, dword [esi]
call dword [0x4ba1e0]
call dword [esi]
mov edi, eax
test edi, edi
js 0x482e43
mov eax, dword [ebp - 0x18]
push 1
push ebx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x18]
mov ecx, esi
call dword [0x4ba1e0]
call esi
mov edi, eax
jmp 0x482e43
mov edi, 0x80070002
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x482e5e
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x4ba1e0]
call esi
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x482e7c
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x4ba1e0]
call esi
mov eax, edi
call fcn.004a53d8
ret
Function at 0x485366
Capabilities:
Inspect section memory permissions

Disassembly:
push 0x10
mov eax, 0x4aa4f7
call fcn.004a5429
mov edi, ecx
call fcn.00485316
mov ebx, eax
mov ecx, ebx
call fcn.0047ffa0
test eax, eax
js 0x4854bc
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
mov eax, dword [ebx + 0x54]
push ecx
push 0x419478
push eax
mov esi, dword [eax]
mov ecx, dword [esi]
call dword [0x4ba1e0]
call dword [esi]
and dword [ebp - 0x18], 0
mov esi, eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], esi
test ecx, ecx
je 0x4853d5
mov edx, dword [ecx]
lea eax, [ebp - 0x18]
push eax
push ecx
mov esi, dword [edx + 0x48]
mov ecx, esi
call dword [0x4ba1e0]
call esi
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x1c]
cmp dword [edi + 0x130], 0
jne 0x485419
push ecx
mov ecx, edi
mov dword [edi + 0x130], 5
call fcn.00485589
mov esi, eax
test esi, esi
jns 0x485404
mov ecx, edi
call fcn.0048592e
mov ecx, ebx
call fcn.0047ffff
push 0
push 1
push 0x43f
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x14]
test esi, esi
js 0x485496
mov eax, dword [edi + 0x130]
cmp eax, 1
je 0x48546b
cmp eax, 2
je 0x485464
cmp eax, 3
je 0x48544d
cmp eax, 4
je 0x485448
cmp eax, 5
jne 0x48548c
push dword [ebp + 0x10]
mov ecx, ebx
call fcn.0043652f
jmp 0x48548c
cmp eax, 3
jne 0x485454
mov eax, 0x40000000
jmp 0x485470
cmp eax, 4
jne 0x485460
mov eax, 0x4000000
jmp 0x485470
xor eax, eax
jmp 0x485470
mov eax, SysReAllocString
jmp 0x485470
mov eax, 0x20000000
mov dword [4], eax
mov eax, dword [edi + 0xec]
cmp eax, dword [edi + 0xf0]
je 0x48548c
push 0
mov ecx, ebx
call fcn.004364e9
mov ecx, ebx
call fcn.0047ffff
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x4854b4
cmp dword [ebp - 0x18], 0
je 0x4854b4
mov eax, dword [ecx]
lea edx, [ebp - 0x18]
push edx
push ecx
mov esi, dword [eax + 0x4c]
mov ecx, esi
call dword [0x4ba1e0]
call esi
lea ecx, [ebp - 0x14]
call fcn.00444adb
call fcn.004a53d8
ret 0xc
Function at 0x48c0d6
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
mov ebx, ecx
mov dword [ebp - 8], eax
mov dword [edi], eax
lea eax, [ebp - 8]
push eax
push edx
call dword [sym.imp.ole32.dll_StringFromCLSID]
mov esi, eax
test esi, esi
js 0x48c156
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [ebp - 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x48c11f
xor esi, esi
inc esi
jmp 0x48c156
push 4
pop ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
lea eax, [ebp - 0x10]
xor ecx, ecx
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ecx
push eax
push ecx
push str.Compatibility_Flags
push dword [ebp - 4]
mov dword [ebp - 0x10], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x48c156
cmp dword [ebp - 0xc], ebx
jne 0x48c156
mov eax, dword [ebp - 0x10]
mov dword [edi], eax
cmp dword [ebp - 4], 0
je 0x48c165
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x48c174
push dword [ebp - 8]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48c17f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x448
mov eax, dword [0x4b6c04]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov dword [ebp - 0x444], edx
mov esi, ecx
xor edi, edi
lea ecx, [ebp - 0x214]
xor ebx, ebx
mov dword [ebp - 0x434], edi
push 0x42f8c8
mov edx, 0x104
mov dword [ebp - 0x430], edi
inc ebx
call fcn.00445f14
test eax, eax
js 0x48c3a8
push 0x4199ec
mov edx, 0x104
lea ecx, [ebp - 0x214]
call fcn.0043c842
test eax, eax
js 0x48c3a8
push str.KillbitList
mov edx, 0x104
lea ecx, [ebp - 0x214]
call fcn.0043c842
test eax, eax
js 0x48c3a8
lea eax, [ebp - 0x434]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x214]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48c37e
mov ecx, dword [ebp - 0x434]
lea eax, [ebp - 0x438]
push eax
mov edx, esi
call fcn.0048c0d6
test eax, eax
js 0x48c37e
test dword [ebp - 0x438], 0x400
jne 0x48c25d
mov ebx, edi
jmp 0x48c37e
lea eax, [ebp - 0x430]
push eax
push esi
call dword [sym.imp.ole32.dll_StringFromCLSID]
test eax, eax
js 0x48c37e
mov dword [ebp - 0x43c], edi
lea eax, [ebp - 0x214]
mov dword [ebp - 0x440], 0x4e
mov esi, 0x104
lea ecx, [ebp - 0x41c]
push eax
mov edx, esi
call fcn.0043c80d
test eax, eax
js 0x48c37e
push 0x4199ec
mov edx, esi
lea ecx, [ebp - 0x41c]
call fcn.0043c842
test eax, eax
js 0x48c37e
push dword [ebp - 0x430]
mov edx, esi
lea ecx, [ebp - 0x41c]
call fcn.00445f14
test eax, eax
js 0x48c37e
lea eax, [ebp - 0x440]
push eax
push dword [ebp - 0x430]
lea eax, [ebp - 0x41c]
push edi
push 0x20000002
push 0x43094c
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x48c37e
mov esi, 0x414cbc
lea edi, [ebp - 0x42c]
lea eax, [ebp - 0x42c]
push eax
push dword [ebp - 0x430]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
js 0x48c37e
mov ecx, dword [ebp - 0x434]
lea eax, [ebp - 0x438]
push eax
lea edx, [ebp - 0x42c]
call fcn.0048c0d6
test eax, eax
js 0x48c355
test dword [ebp - 0x438], 0x400
je 0x48c36e
mov esi, dword [ebp - 0x43c]
inc esi
mov dword [ebp - 0x43c], esi
cmp esi, 0xa
jge 0x48c37e
xor edi, edi
jmp 0x48c279
mov edi, dword [ebp - 0x444]
lea esi, [ebp - 0x42c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x434], 0
je 0x48c393
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x430], 0
je 0x48c3a8
push dword [ebp - 0x430]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a4e80
mov esp, ebp
pop ebp
ret 4