joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447834
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4478d2
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xc]
je 0x447896
cmp byte [ebx + 0x10], 0
jne 0x447896
cmp byte [ebx + 0x3c], 0
jne 0x447896
mov byte [ebx + 0xe], 0
mov byte [ebx + 0xc], 0
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4478b7
lea edx, [ebp - 4]
mov eax, dword [0x4b9674]
call fcn.0040a810
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x439958]
call fcn.004220f0
call fcn.004061b8
jmp 0x4478b7
lea edx, [ebp - 8]
mov eax, dword [0x4b9674]
call fcn.0040a810
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x439958]
call fcn.004220f0
call fcn.004061b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4478d9
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ba0
ret

Function at 0x447bf0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xe]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x447c3e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.0044776c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x447c57
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x447c60
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0044776c
dec esi
jne 0x447c82
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x44d588
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x44d624
push 0
mov eax, ebx
call fcn.00407984
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
test ebx, ebx
jne 0x44d5ff
mov ebx, esi
test ebx, ebx
je 0x44d5d1
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.00407984
push eax
push 1
push 0
mov eax, edi
call fcn.00407984
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x44d61a
mov ecx, dword [0x4b94a4]
mov dl, 1
mov eax, dword [0x44b9f0]
call fcn.004221ac
call fcn.004061b8
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x44d640
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, ebx
call fcn.00406b40
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, esi
call fcn.00407984
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x44d6fc
xor eax, eax
push ebp
push 0x44d6f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00407b08
mov eax, dword [ebp - 8]
add eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx]
call fcn.00407984
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00407984
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x44d6d7
mov edx, dword [ebp - 8]
shr edx, 1
dec edx
mov eax, ebx
call fcn.00407b08
jmp 0x44d6de
mov eax, ebx
call fcn.00406b40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d6fc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x450b44
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x450b96
test eax, edx
je 0x450b99
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x450b59
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x450b7f
add ecx, 4
js 0x450b6f
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x450b7c
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x450ba5
test edx, edx
jne 0x450b4c
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret
Function at 0x456ebc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x456f92
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor esi, esi
push ebp
push 0x456f65
push dword fs:[esi]
mov dword fs:[esi], esp
test dl, dl
je 0x456f16
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00407a80
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0041b9b8
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, 0xfde9
call fcn.004072e0
jmp 0x456f25
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0xfde9
call fcn.0040763c
mov eax, 1
mov edx, dword [ebp - 4]
test edx, edx
je 0x456f36
sub edx, 4
mov edx, dword [edx]
test edx, edx
jle 0x456f58
mov ecx, 1
imul eax, eax, 0x5517e877
mov ebx, dword [ebp - 4]
movzx ebx, byte [ebx + ecx - 1]
xor eax, dword [ebx*4 + 0x4b7e3c]
inc ecx
dec edx
jne 0x456f3f
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x456f6f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456f99
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00406c00
lea eax, [ebp - 4]
call fcn.00406b64
ret

Function at 0x456fa4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x4570c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor ecx, ecx
push ebp
push 0x457097
push dword fs:[ecx]
mov dword fs:[ecx], esp
test dl, dl
je 0x45700f
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.00407a80
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0041b9b8
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov ecx, 0xfde9
call fcn.004072e0
jmp 0x45701e
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0xfde9
call fcn.0040763c
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x457038
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x457081
mov esi, 1
push 0
push 0x5517e877
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00408778
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi - 1]
mov edx, dword [eax*8 + 0x4b8244]
mov eax, dword [eax*8 + 0x4b8240]
xor eax, dword [ebp - 0x18]
xor edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
inc esi
dec ebx
jne 0x457043
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4570a1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4570cb
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00406c00
lea eax, [ebp - 4]
call fcn.00406b64
ret
Function at 0x45a378
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00406c24
mov eax, dword [ebp - 8]
call fcn.00406c24
xor eax, eax
push ebp
push 0x45a48b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor ebx, ebx
mov eax, dword [0x4b93a8]
cmp byte [eax], 0
je 0x45a3de
call fcn.0040ab14
cmp byte [eax + 0x15], 0
je 0x45a3cb
mov ebx, pe_nt_image_headers32
jmp 0x45a3de
call fcn.0040ab14
cmp byte [eax + 0x14], 0
je 0x45a3de
mov ebx, 0x200
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
or ebx, 0x20006
push ebx
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00407984
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
push ebx
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x45a470
cmp dword [ebp - 8], 0
jne 0x45a439
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
test ebx, ebx
sete byte [ebp - 9]
jmp 0x45a461
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00407984
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
test ebx, ebx
sete byte [ebp - 9]
push ebx
call sub.kernel32.dll_SetLastError
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a492
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ba0
ret
Function at 0x45a4a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00406c24
mov eax, dword [ebp - 8]
call fcn.00406c24
xor eax, eax
push ebp
push 0x45a5e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [edi], eax
xor ebx, ebx
mov eax, dword [0x4b93a8]
cmp byte [eax], 0
je 0x45a516
call fcn.0040ab14
cmp byte [eax + 0x15], 0
je 0x45a503
mov ebx, pe_nt_image_headers32
jmp 0x45a516
call fcn.0040ab14
cmp byte [eax + 0x14], 0
je 0x45a516
mov ebx, 0x200
lea eax, [ebp - 0x18]
push eax
or ebx, 0x20019
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.00407984
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x45a5c5
cmp dword [ebp - 8], 0
jne 0x45a547
xor ebx, ebx
jmp 0x45a551
mov eax, dword [ebp - 8]
call fcn.00407984
mov ebx, eax
lea eax, [ebp - 0x20]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x45a5bc
mov eax, dword [ebp - 0x20]
call fcn.004044f0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x45a5b4
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x45a5aa
mov eax, dword [ebp - 0x1c]
mov dword [esi], eax
mov eax, dword [ebp - 0x20]
mov dword [edi], eax
mov byte [ebp - 0xd], 1
jmp 0x45a5bc
mov eax, dword [ebp - 0x1c]
call fcn.0040450c
jmp 0x45a5bc
mov eax, dword [ebp - 0x1c]
call fcn.0040450c
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a5e7
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ba0
ret

Function at 0x45a8c8
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, ecx
mov edi, edx
mov esi, eax
mov byte [esp], 0
xor ebx, ebx
mov eax, dword [0x4b93a8]
cmp byte [eax], 0
je 0x45a90d
call fcn.0040ab14
cmp byte [eax + 0x15], 0
je 0x45a8fa
mov ebx, pe_nt_image_headers32
jmp 0x45a90d
call fcn.0040ab14
cmp byte [eax + 0x14], 0
je 0x45a90d
mov ebx, 0x200
lea eax, [esp + 4]
push eax
or ebx, 0x20006
push ebx
push 0
mov eax, edi
call fcn.00407984
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
mov ebx, eax
push ebx
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x45a957
mov eax, ebp
call fcn.00407984
push eax
mov eax, dword [esp + 8]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete byte [esp]
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
movzx eax, byte [esp]
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x45a964
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [0x4b93a8]
cmp byte [eax], 0
jne 0x45a996
mov eax, dword [ebp - 8]
call fcn.00407984
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov ebx, eax
jmp 0x45aa17
xor eax, eax
push ebp
push 0x45a9f9
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [0x4b93a8]
cmp byte [eax], 0
je 0x45a9d8
call fcn.0040ab14
cmp byte [eax + 0x15], 0
je 0x45a9c5
mov ebx, pe_nt_image_headers32
jmp 0x45a9d8
call fcn.0040ab14
cmp byte [eax + 0x14], 0
je 0x45a9d8
mov ebx, 0x200
push 0
push ebx
mov eax, dword [ebp - 8]
call fcn.00407984
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45aa17
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x45ab34
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 0x11], cl
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x45ad24
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 0x10]
mov eax, 0x45ad40
call fcn.00407efc
test eax, eax
je 0x45ad01
cmp byte [ebp - 0x11], 0
je 0x45acf4
xor edx, edx
push ebp
push 0x45acea
push dword fs:[edx]
mov dword fs:[edx], esp
xor esi, esi
mov eax, dword [0x4b93a8]
cmp byte [eax], 0
je 0x45abc2
call fcn.0040ab14
cmp byte [eax + 0x15], 0
je 0x45abaf
mov esi, pe_nt_image_headers32
jmp 0x45abc2
call fcn.0040ab14
cmp byte [eax + 0x14], 0
je 0x45abc2
mov esi, 0x200
lea eax, [ebp - 0x18]
push eax
or esi, 0x2000f
push esi
push 0
mov eax, dword [ebp - 0x10]
call fcn.00407984
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
xor edx, edx
push ebp
push 0x45acd9
push dword fs:[edx]
mov dword fs:[edx], esp
test eax, eax
jne 0x45acb8
xor eax, eax
mov dword [ebp - 0x20], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryInfoKeyW
test eax, eax
jne 0x45acb8
mov esi, dword [ebp - 0x20]
dec esi
cmp esi, 0
jl 0x45acb8
mov eax, dword [0x4b8aa8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x1c]
call fcn.00407b08
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
call fcn.004070f4
push eax
push esi
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x45acae
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x1c]
call fcn.00407b08
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x10]
call fcn.00423210
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
call fcn.00407be0
movzx ecx, byte [ebp - 0x11]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0045ab34
test al, al
jne 0x45acae
call fcn.004062ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45ad01
dec esi
cmp esi, 0xffffffff
jne 0x45ac32
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ace0
lea eax, [ebp - 4]
xor edx, edx
call fcn.00407b08
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0045aa20
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ad2b
lea eax, [ebp - 0x24]
call fcn.00406b40
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ba0
ret
Function at 0x45b0fc
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov byte [ebp - 1], 6
xor edx, edx
push ebp
push 0x45b1df
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call sub.kernel32.dll_GetVersionExW
mov eax, dword [ebp - 0x110]
cmp eax, 2
jne 0x45b19a
mov byte [ebp - 1], 4
mov eax, dword [ebp - 0x11c]
cmp eax, 6
jb 0x45b176
mov byte [ebp - 1], 9
cmp byte [ebp - 6], 1
jne 0x45b163
cmp dword [ebp - 0x118], 1
jb 0x45b1d5
mov byte [ebp - 1], 0xc
jmp 0x45b1d5
mov byte [ebp - 1], 0xa
cmp dword [ebp - 0x118], 1
jb 0x45b1d5
mov byte [ebp - 1], 0xb
jmp 0x45b1d5
cmp eax, 5
jb 0x45b1d5
mov byte [ebp - 1], 5
cmp dword [ebp - 0x118], 1
jb 0x45b1d5
cmp byte [ebp - 6], 1
jne 0x45b194
mov byte [ebp - 1], 6
jmp 0x45b1d5
mov byte [ebp - 1], 8
jmp 0x45b1d5
cmp eax, 1
jne 0x45b1d1
mov byte [ebp - 1], 0
cmp dword [ebp - 0x11c], 4
jne 0x45b1b9
cmp dword [ebp - 0x118], 0xa
jne 0x45b1b9
mov byte [ebp - 1], 1
cmp dword [ebp - 0x11c], 4
jne 0x45b1d5
cmp dword [ebp - 0x118], 0x5a
jne 0x45b1d5
mov byte [ebp - 1], 2
jmp 0x45b1d5
mov byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45b1e9
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45bb4c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406c24
xor eax, eax
push ebp
push 0x45bcab
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00406b40
mov edx, dword [ebp - 4]
mov eax, 0x45bcc8
call fcn.00407efc
test eax, eax
jne 0x45bc1b
lea eax, [ebp - 8]
mov edx, 1
call fcn.00407b08
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00407984
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00407984
mov edi, eax
push edi
push 0
call sub.kernel32.dll_SearchPathW
mov ebx, eax
inc ebx
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00407b08
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00407984
push eax
push ebx
push 0
push edi
push 0
call sub.kernel32.dll_SearchPathW
test eax, eax
je 0x45bc0f
mov eax, dword [ebp - 8]
call fcn.00407984
call fcn.00407058
lea edx, [ebp - 8]
xchg edx, eax
call fcn.00407b08
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.00406f20
jmp 0x45bc90
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00406f20
jmp 0x45bc90
lea eax, [ebp - 8]
mov edx, 1
call fcn.00407b08
push 0
mov eax, dword [ebp - 8]
call fcn.00407984
push eax
mov eax, dword [ebp - 4]
call fcn.00407984
mov edi, eax
push edi
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov ebx, eax
inc ebx
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00407b08
push ebx
mov eax, dword [ebp - 8]
call fcn.00407984
push eax
push edi
call sub.kernel32.dll_ExpandEnvironmentStringsW
test eax, eax
je 0x45bc86
mov eax, dword [ebp - 8]
call fcn.00407984
call fcn.00407058
lea edx, [ebp - 8]
xchg edx, eax
call fcn.00407b08
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.00406f20
jmp 0x45bc90
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00406f20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bcb2
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ba0
ret

Function at 0x45c194
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45c263
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00406b40
xor edx, edx
push ebp
push 0x45c240
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xff
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
test eax, eax
je 0x45c236
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.004079dc
mov eax, dword [ebx]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
test eax, eax
je 0x45c206
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x45c21c
mov eax, ebx
mov edx, 0x45c280
call fcn.00407b88
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0045c144
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00406f20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45c24a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c26a
lea eax, [ebp - 0x208]
call fcn.00406b40
ret
Function at 0x45c284
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov dword [ebp - 0x204], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45c378
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00406b40
xor edx, edx
push ebp
push 0x45c350
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x200]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathW
test eax, eax
je 0x45c346
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.004079dc
lea edx, [ebp - 0x204]
mov eax, dword [ebx]
call fcn.0045d454
mov edx, dword [ebp - 0x204]
mov eax, ebx
call fcn.00406f20
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0045c144
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00406f20
mov eax, dword [ebx]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
test eax, eax
je 0x45c330
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x45c346
mov eax, ebx
mov edx, 0x45c394
call fcn.00407b88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45c35a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c37f
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.00406ba0
ret
Function at 0x45c398
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x45c52c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x45c4ff
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.0045b1f4
cmp al, 9
jb 0x45c477
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00407b08
xor edx, edx
push ebp
push 0x45c470
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00407984
push eax
push 0
push 0
push 0x1a
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x45c458
mov eax, dword [ebp - 4]
call fcn.00407984
mov edx, dword [ebp - 8]
call fcn.0041da14
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x45c42a
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x45c446
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00423210
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00406f20
call fcn.004062ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45c509
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c477
lea eax, [ebp - 4]
xor edx, edx
call fcn.00407b08
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x4b9530]
mov eax, dword [eax]
mov ecx, 0x45c548
mov edx, 0x45c564
call fcn.0045a6dc
test al, al
je 0x45c4f5
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0045c144
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00406f20
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x45c4c3
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x45c4f5
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x45c4d8
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x45c4f5
mov eax, dword [ebp - 8]
mov edx, 0x45c5f4
call fcn.00407b88
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45c509
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c533
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00406ba0
lea eax, [ebp - 4]
call fcn.00406b40
ret