joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4536b0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x5c0c70]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], ecx
mov byte [ebp - 0x68], 0
push 0x3f
push 0
lea eax, [ebp - 0x67]
push eax
call fcn.0053ef70
add esp, 0xc
mov byte [ebp - 0xc8], 0
push 0x3f
push 0
lea ecx, [ebp - 0xc7]
push ecx
call fcn.0053ef70
add esp, 0xc
mov byte [ebp - 0x24], 0
xor edx, edx
mov dword [ebp - 0x23], edx
mov dword [ebp - 0x1f], edx
mov dword [ebp - 0x1b], edx
mov dword [ebp - 0x17], edx
mov dword [ebp - 0x13], edx
mov dword [ebp - 0xf], edx
mov dword [ebp - 0xb], edx
mov word [ebp - 7], dx
mov byte [ebp - 5], dl
mov byte [ebp - 0x88], 0
xor eax, eax
mov dword [ebp - 0x87], eax
mov dword [ebp - 0x83], eax
mov dword [ebp - 0x7f], eax
mov dword [ebp - 0x7b], eax
mov dword [ebp - 0x77], eax
mov dword [ebp - 0x73], eax
mov dword [ebp - 0x6f], eax
mov word [ebp - 0x6b], ax
mov byte [ebp - 0x69], al
mov byte [ebp - 0x108], 0
push 0x3f
push 0
lea ecx, [ebp - 0x107]
push ecx
call fcn.0053ef70
add esp, 0xc
push 0x40
lea edx, [ebp - 0x68]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x114]
call fcn.00453390
lea ecx, [ebp - 0xc8]
push ecx
lea edx, [ebp - 0x68]
push edx
mov ecx, dword [ebp - 0x114]
call fcn.00453a60
push 0x20
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.0053e160
add esp, 0xc
push 0x20
lea edx, [ebp - 0xa8]
push edx
lea eax, [ebp - 0x88]
push eax
call fcn.0053e160
add esp, 0xc
mov dword [ebp - 0x10c], 0
jmp 0x4537d1
mov ecx, dword [ebp - 0x10c]
add ecx, 1
mov dword [ebp - 0x10c], ecx
cmp dword [ebp - 0x10c], 0x10
jge 0x4537fd
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x88]
push ecx
lea edx, [ebp - 0x24]
push edx
mov ecx, dword [ebp - 0x114]
call fcn.004538b0
jmp 0x4537c2
push 0x20
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.0053e160
add esp, 0xc
push 0x20
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0xe8]
push eax
call fcn.0053e160
add esp, 0xc
mov dword [ebp - 0x110], 0
jmp 0x453845
mov ecx, dword [ebp - 0x110]
add ecx, 1
mov dword [ebp - 0x110], ecx
cmp dword [ebp - 0x110], 0x40
jge 0x453876
mov edx, dword [ebp - 0x110]
movsx eax, byte [edx + 0x57b288]
mov ecx, dword [ebp - 0x114]
add ecx, dword [ebp - 0x110]
mov dl, byte [ebp + eax - 0x109]
mov byte [ecx + 0x600], dl
jmp 0x453836
push 0x40
mov eax, dword [ebp - 0x114]
add eax, 0x600
push eax
mov ecx, dword [ebp - 0x114]
add ecx, 0x680
push ecx
mov ecx, dword [ebp - 0x114]
call fcn.00453cc0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053ea90
mov esp, ebp
pop ebp
ret 8

Function at 0x453a60
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
jmp 0x453a7b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x40
jge 0x453a9c
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + str.:2_]
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + edx - 1]
mov byte [eax], dl
jmp 0x453a72
mov esp, ebp
pop ebp
ret 8
Function at 0x453ab0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
jmp 0x453acb
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x30
jge 0x453aec
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x57b038]
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + edx - 1]
mov byte [eax], dl
jmp 0x453ac2
mov esp, ebp
pop ebp
ret 8

Function at 0x453c70
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
jmp 0x453c8b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x20
jge 0x453cac
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x57b268]
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + edx - 1]
mov byte [eax], dl
jmp 0x453c82
mov esp, ebp
pop ebp
ret 8

Function at 0x454590
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x5c0c70]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x438], ecx
mov dword [ebp - 0x430], 0x428
push 0x424
push 0
lea eax, [ebp - 0x42c]
push eax
call fcn.0053ef70
add esp, 0xc
push 0
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0xffffffff
jne 0x4545e5
xor eax, eax
jmp 0x454664
lea ecx, [ebp - 0x430]
push ecx
mov edx, dword [ebp - 0x434]
push edx
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x454648
mov eax, dword [ebp + 8]
sub eax, dword [ebp - 0x41c]
cmp eax, dword [ebp - 0x418]
jae 0x454631
lea ecx, [ebp - 0x410]
push ecx
mov edx, dword [ebp - 0x438]
add edx, 0x10
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x41c]
mov dword [eax], ecx
jmp 0x454648
lea edx, [ebp - 0x430]
push edx
mov eax, dword [ebp - 0x434]
push eax
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x4545fc
mov ecx, dword [ebp - 0x434]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x438]
add eax, 0x10
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053ea90
mov esp, ebp
pop ebp
ret 8
Function at 0x454680
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x5c0c70]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x244], ecx
xor eax, eax
mov ecx, dword [ebp + 8]
mov word [ecx], ax
mov dword [ebp - 0x240], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x238], 0x22c
lea edx, [ebp - 0x238]
push edx
mov eax, dword [ebp - 0x240]
push eax
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x23c]
call fcn.0040ee90
cmp dword [ebp - 4], 0
je 0x454727
lea ecx, [ebp - 0x214]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00544cd0
add esp, 8
push 0x582f50
mov eax, dword [ebp + 8]
push eax
call fcn.00544cd0
add esp, 8
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x240]
push edx
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 4], eax
jmp 0x4546e5
mov eax, dword [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x23c]
call fcn.0040f740
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0053ea90
mov esp, ebp
pop ebp
ret 4

Function at 0x4550f0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x5c0c70]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x828], ecx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x828]
mov edx, dword [ecx + 4]
or edx, 0x20019
push edx
push 0
mov ecx, dword [ebp - 0x828]
add ecx, 0x10
call fcn.0041cb20
push eax
mov eax, dword [ebp - 0x828]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x455149
xor eax, eax
jmp 0x455202
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xc]
call fcn.0040ee90
mov dword [ebp - 0x10], 0x80
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x818]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4551c2
lea eax, [ebp - 0x818]
push eax
lea ecx, [ebp - 0x81c]
call fcn.0041c8a0
lea ecx, [ebp - 0x81c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004b2b50
lea ecx, [ebp - 0x81c]
call fcn.0040f740
mov dword [ebp - 0x10], 0x80
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x45515f
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4551ea
mov dword [ebp - 0x820], 0
lea ecx, [ebp - 0xc]
call fcn.0040f740
mov eax, dword [ebp - 0x820]
jmp 0x455202
mov dword [ebp - 0x824], 1
lea ecx, [ebp - 0xc]
call fcn.0040f740
mov eax, dword [ebp - 0x824]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0053ea90
mov esp, ebp
pop ebp
ret 4
Function at 0x455220
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5c0c70]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], ecx
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.0053ef70
add esp, 0xc
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x214]
call fcn.0041c8a0
lea ecx, [ebp - 0x214]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0041c880
lea ecx, [ebp - 0x214]
call fcn.0040f740
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053ea90
mov esp, ebp
pop ebp
ret 4
Function at 0x466c00
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x5c0c70]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], ecx
mov byte [ebp - 0x68], 0
push 0x3f
push 0
lea eax, [ebp - 0x67]
push eax
call fcn.0053ef70
add esp, 0xc
mov byte [ebp - 0xc8], 0
push 0x3f
push 0
lea ecx, [ebp - 0xc7]
push ecx
call fcn.0053ef70
add esp, 0xc
mov byte [ebp - 0x24], 0
xor edx, edx
mov dword [ebp - 0x23], edx
mov dword [ebp - 0x1f], edx
mov dword [ebp - 0x1b], edx
mov dword [ebp - 0x17], edx
mov dword [ebp - 0x13], edx
mov dword [ebp - 0xf], edx
mov dword [ebp - 0xb], edx
mov word [ebp - 7], dx
mov byte [ebp - 5], dl
mov byte [ebp - 0x88], 0
xor eax, eax
mov dword [ebp - 0x87], eax
mov dword [ebp - 0x83], eax
mov dword [ebp - 0x7f], eax
mov dword [ebp - 0x7b], eax
mov dword [ebp - 0x77], eax
mov dword [ebp - 0x73], eax
mov dword [ebp - 0x6f], eax
mov word [ebp - 0x6b], ax
mov byte [ebp - 0x69], al
mov byte [ebp - 0x108], 0
push 0x3f
push 0
lea ecx, [ebp - 0x107]
push ecx
call fcn.0053ef70
add esp, 0xc
push 0x40
lea edx, [ebp - 0x68]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x114]
call fcn.00453390
lea ecx, [ebp - 0xc8]
push ecx
lea edx, [ebp - 0x68]
push edx
mov ecx, dword [ebp - 0x114]
call fcn.00453a60
push 0x20
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x88]
push ecx
call fcn.0053e160
add esp, 0xc
push 0x20
lea edx, [ebp - 0xa8]
push edx
lea eax, [ebp - 0x24]
push eax
call fcn.0053e160
add esp, 0xc
mov dword [ebp - 0x10c], 0
jmp 0x466d21
mov ecx, dword [ebp - 0x10c]
add ecx, 1
mov dword [ebp - 0x10c], ecx
cmp dword [ebp - 0x10c], 0x10
jge 0x466d52
mov edx, dword [ebp + 0xc]
push edx
mov eax, 0xf
sub eax, dword [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x88]
push edx
mov ecx, dword [ebp - 0x114]
call fcn.004538b0
jmp 0x466d12
push 0x20
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.0053e160
add esp, 0xc
push 0x20
lea edx, [ebp - 0x88]
push edx
lea eax, [ebp - 0xe8]
push eax
call fcn.0053e160
add esp, 0xc
mov dword [ebp - 0x110], 0
jmp 0x466d9a
mov ecx, dword [ebp - 0x110]
add ecx, 1
mov dword [ebp - 0x110], ecx
cmp dword [ebp - 0x110], 0x40
jge 0x466dcb
mov edx, dword [ebp - 0x110]
movsx eax, byte [edx + 0x57b288]
mov ecx, dword [ebp - 0x114]
add ecx, dword [ebp - 0x110]
mov dl, byte [ebp + eax - 0x109]
mov byte [ecx + 0x640], dl
jmp 0x466d8b
push 0x40
mov eax, dword [ebp - 0x114]
add eax, 0x640
push eax
mov ecx, dword [ebp - 0x114]
add ecx, 0x688
push ecx
mov ecx, dword [ebp - 0x114]
call fcn.00453cc0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053ea90
mov esp, ebp
pop ebp
ret 8
Function at 0x477070
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 4]
or edx, 2
push edx
push 0
mov ecx, dword [ebp - 0x18]
add ecx, 0x10
call fcn.0041cb20
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4770ba
mov dword [ebp - 0xc], 0
lea ecx, [ebp + 8]
call fcn.0040f740
mov eax, dword [ebp - 0xc]
jmp 0x477106
lea ecx, [ebp + 8]
call fcn.0041cb20
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
jne 0x4770f4
mov dword [ebp - 0x10], 1
lea ecx, [ebp + 8]
call fcn.0040f740
mov eax, dword [ebp - 0x10]
jmp 0x477106
mov dword [ebp - 0x14], 0
lea ecx, [ebp + 8]
call fcn.0040f740
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 4

Function at 0x477110
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 4
mov dword [ebp - 8], 4
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 4]
or edx, 0x20019
push edx
push 0
mov ecx, dword [ebp - 0x1c]
add ecx, 0x10
call fcn.0041cb20
push eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x47716a
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
lea ecx, [ebp + 8]
call fcn.0040f740
mov eax, dword [ebp - 0x14]
jmp 0x4771b0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 4]
push edx
push 0
lea ecx, [ebp + 8]
call fcn.0041cb20
push eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x477195
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
lea ecx, [ebp + 8]
call fcn.0040f740
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 8
Function at 0x4771c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x5c0c70]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0xc], 1
lea ecx, [ebp + 0xc]
call fcn.0041cc20
cmp eax, 0x9ec
jle 0x477214
mov dword [ebp - 0x214], 0
lea ecx, [ebp + 8]
call fcn.0040f740
lea ecx, [ebp + 0xc]
call fcn.0040f740
mov eax, dword [ebp - 0x214]
jmp 0x477309
lea ecx, [ebp + 0xc]
call fcn.0041cb20
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x220]
mov eax, dword [edx + 4]
or eax, 0x20006
push eax
push 0
mov ecx, dword [ebp - 0x220]
add ecx, 0x10
call fcn.0041cb20
push eax
mov ecx, dword [ebp - 0x220]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x477287
mov dword [ebp - 0x218], 0
lea ecx, [ebp + 8]
call fcn.0040f740
lea ecx, [ebp + 0xc]
call fcn.0040f740
mov eax, dword [ebp - 0x218]
jmp 0x477309
lea eax, [ebp - 0x210]
push eax
call fcn.0053f78e
add esp, 4
lea ecx, [eax + eax + 2]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x210]
push eax
push 1
push 0
lea ecx, [ebp + 8]
call fcn.0041cb20
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x4772ca
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 0x220]
cmp dword [edx + 0xc], 0
jne 0x4772e0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x21c], edx
lea ecx, [ebp + 8]
call fcn.0040f740
lea ecx, [ebp + 0xc]
call fcn.0040f740
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053ea90
mov esp, ebp
pop ebp
ret 8

Function at 0x477320
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], 1
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 4]
or edx, 0x20006
push edx
push 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
call fcn.0041cb20
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x477374
mov dword [ebp - 0xc], 0
lea ecx, [ebp + 8]
call fcn.0040f740
mov eax, dword [ebp - 0xc]
jmp 0x4773ca
push 4
lea edx, [ebp + 0xc]
push edx
push 4
push 0
lea ecx, [ebp + 8]
call fcn.0041cb20
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x47739c
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0xc], 0
jne 0x4773af
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
lea ecx, [ebp + 8]
call fcn.0040f740
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 8
Function at 0x47a670
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x16c]
call eax
push eax
lea ecx, [ebp - 4]
call fcn.0041c880
push 5
push 0
push 0
lea ecx, [ebp - 4]
call fcn.0041cb20
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
call fcn.0040f740
mov esp, ebp
pop ebp
ret 0xc

Function at 0x47a6c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 1
push ecx
mov ecx, esp
push 0x582b94
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x58a24c
call fcn.0041c8a0
mov ecx, 0x5c2f20
call fcn.0044e4b0
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x16c]
call eax
push eax
lea ecx, [ebp - 4]
call fcn.0041c880
push 5
push 0
push 0
lea ecx, [ebp - 4]
call fcn.0041cb20
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
call fcn.0040f740
mov esp, ebp
pop ebp
ret 0xc
Function at 0x47b580
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
push 0x582b94
lea ecx, [ebp - 0xc]
call fcn.0041c8a0
call fcn.00451f00
test eax, eax
setne al
mov byte [ebp - 5], al
movzx ecx, byte [ebp - 5]
test ecx, ecx
je 0x47b617
mov edx, dword [0x5c272c]
push edx
push str._smytime.dll
lea eax, [ebp - 0xc]
push eax
call fcn.004ea900
add esp, 0xc
push 0
lea ecx, [ebp - 0xc]
call fcn.0041cb20
push eax
push 0x58a81c
push 0xd5
call fcn.004431d0
add esp, 0x10
mov ecx, dword [0x5c272c]
push ecx
push str._smytimeinj.exe
lea edx, [ebp - 0xc]
push edx
call fcn.004ea900
add esp, 0xc
push 0
lea ecx, [ebp - 0xc]
call fcn.0041cb20
push eax
push 0x58a81c
push 0xd4
call fcn.004431d0
add esp, 0x10
jmp 0x47b64b
mov eax, dword [0x5c272c]
push eax
push str._smytime.dll
lea ecx, [ebp - 0xc]
push ecx
call fcn.004ea900
add esp, 0xc
push 0
lea ecx, [ebp - 0xc]
call fcn.0041cb20
push eax
push 0x58a81c
push 0xd6
call fcn.004431d0
add esp, 0x10
mov edx, dword [0x5c272c]
push edx
push str._s_sound_remind.wav
lea eax, [ebp - 0xc]
push eax
call fcn.004ea900
add esp, 0xc
lea ecx, [ebp - 0xc]
call fcn.0041cb20
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x47b693
push 0
lea ecx, [ebp - 0xc]
call fcn.0041cb20
push eax
push 0x58a7c4
push 0xdb
call fcn.004431d0
add esp, 0x10
mov ecx, dword [0x5c2494]
push ecx
mov edx, dword [0x5c2728]
push edx
push str._s_d.xml
lea eax, [ebp - 0xc]
push eax
call fcn.004ea900
add esp, 0x10
push 0
lea ecx, [ebp - 0xc]
call fcn.0041cb20
push eax
push 0x5873c0
mov ecx, dword [0x5c2494]
sub ecx, 0x713
movzx edx, cx
push edx
call fcn.004431d0
add esp, 0x10
mov eax, dword [0x5c272c]
push eax
push str._sweathericondefault.icn
lea ecx, [ebp - 0xc]
push ecx
call fcn.004ea900
add esp, 0xc
lea ecx, [ebp - 0xc]
call fcn.0041cb20
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x47b721
push 0
lea ecx, [ebp - 0xc]
call fcn.0041cb20
push eax
push 0x58a81c
push 0xd9
call fcn.004431d0
add esp, 0x10
mov edx, dword [0x5c2728]
push edx
push str._sweatherlist.xml
lea eax, [ebp - 0xc]
push eax
call fcn.004ea900
add esp, 0xc
push 0
mov ecx, 0x5c28c8
call fcn.0040f350
push 1
mov ecx, 0x5c28c8
call fcn.0040f330
push ecx
mov ecx, esp
push str.WeatherList
call fcn.0041c8a0
push ecx
mov ecx, esp
lea edx, [ebp - 0xc]
push edx
call fcn.0041c880
mov ecx, 0x5c28c8
call fcn.00465f40
mov eax, dword [0x5c2728]
push eax
push str._smytimeset.cfg
lea ecx, [ebp - 0xc]
push ecx
call fcn.004ea900
add esp, 0xc
push 0
mov ecx, 0x5c2870
call fcn.0040f350
push 1
mov ecx, 0x5c2870
call fcn.0040f330
push ecx
mov ecx, esp
push str.mytimeset
call fcn.0041c8a0
push ecx
mov ecx, esp
lea edx, [ebp - 0xc]
push edx
call fcn.0041c880
mov ecx, 0x5c2870
call fcn.00465f40
push ecx
mov ecx, esp
push str.Changed
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x58a6f0
call fcn.0041c8a0
mov ecx, 0x5c2870
call fcn.0047b810
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x47b7fb
mov ecx, dword [ebp - 0x28]
call fcn.00481110
lea ecx, [ebp - 0xc]
call fcn.0040f740
mov esp, ebp
pop ebp
ret
Function at 0x47ba80
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 0x60], ecx
lea ecx, [ebp - 0x28]
call fcn.004524b0
lea ecx, [ebp - 8]
call fcn.0040ee90
lea ecx, [ebp - 0x10]
call fcn.0040ee90
lea ecx, [ebp - 0xc]
call fcn.0040ee90
lea ecx, [ebp - 4]
call fcn.0040ee90
push ecx
mov ecx, esp
lea eax, [ebp + 8]
push eax
call fcn.0041c880
push ecx
mov ecx, esp
push 0x5c2730
call fcn.0041c880
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00452750
push eax
lea ecx, [ebp - 0xc]
call fcn.0041c8e0
lea ecx, [ebp - 0x38]
call fcn.0040f740
push ecx
mov ecx, esp
lea edx, [ebp + 8]
push edx
call fcn.0041c880
push ecx
mov ecx, esp
push 0x5c272c
call fcn.0041c880
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x28]
call fcn.00452750
push eax
lea ecx, [ebp - 8]
call fcn.0041c8e0
lea ecx, [ebp - 0x44]
call fcn.0040f740
lea ecx, [ebp - 0xc]
call fcn.0041cb20
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47bbda
lea ecx, [ebp - 0xc]
call fcn.0041cb20
push eax
lea ecx, [ebp - 0x48]
push ecx
call fcn.004476c0
add esp, 8
push eax
lea ecx, [ebp - 4]
call fcn.0041c8e0
lea ecx, [ebp - 0x48]
call fcn.0040f740
lea ecx, [ebp - 8]
call fcn.0041cb20
push eax
lea edx, [ebp - 0x4c]
push edx
call fcn.004476c0
add esp, 8
push eax
lea ecx, [ebp - 0x10]
call fcn.0041c8e0
lea ecx, [ebp - 0x4c]
call fcn.0040f740
push ecx
mov ecx, esp
lea eax, [ebp - 4]
push eax
call fcn.0041c880
push ecx
mov ecx, esp
lea edx, [ebp - 0x10]
push edx
call fcn.0041c880
call fcn.00445f60
add esp, 8
mov byte [ebp - 0x29], al
movzx eax, byte [ebp - 0x29]
test eax, eax
je 0x47bbcb
push ecx
mov ecx, esp
lea edx, [ebp - 8]
push edx
call fcn.0041c880
push ecx
mov ecx, esp
lea eax, [ebp - 0xc]
push eax
call fcn.0041c880
call fcn.004461c0
add esp, 8
lea ecx, [ebp - 0xc]
call fcn.0041cb20
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
je 0x47bc2c
lea ecx, [ebp - 8]
call fcn.0041cb20
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47bc2c
mov edx, dword [ebp - 0x60]
cmp dword [edx + 0x480], 0
je 0x47bc2c
push 0x588c2c
lea ecx, [ebp + 8]
call fcn.00453fe0
test eax, eax
jne 0x47bc2c
push 2
push 0
push 0
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax + 0x480]
add ecx, 0x2d8
call fcn.004b4680
lea ecx, [ebp - 4]
call fcn.0040f740
lea ecx, [ebp - 0xc]
call fcn.0040f740
lea ecx, [ebp - 0x10]
call fcn.0040f740
lea ecx, [ebp - 8]
call fcn.0040f740
lea ecx, [ebp - 0x28]
call fcn.004524d0
lea ecx, [ebp + 8]
call fcn.0040f740
mov esp, ebp
pop ebp
ret 8