joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461910
Capabilities:
Read .ini file

Disassembly:
push 0x864
mov eax, 0x5c181c
call fcn.004aa3a5
mov ebx, ecx
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cdq
push edx
push eax
lea eax, [ebp - 0x828]
push eax
call fcn.00470fad
add esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 0x828]
push eax
lea ecx, [ebp - 0x858]
call fcn.00403fb0
push 0x800
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 1
push 0
push eax
call fcn.00486960
lea ecx, [ebx + 0xd4]
add esp, 0xc
cmp dword [ecx + 0x14], 8
jb 0x46197a
mov ecx, dword [ecx]
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
push ecx
cmovae eax, dword [ebp - 0x828]
lea ecx, [ebp - 0x810]
push 0x400
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
and dword [ebp - 0x830], 0
xor eax, eax
mov dword [ebp - 0x82c], 7
mov word [ebp - 0x840], ax
cmp word [ebp - 0x810], ax
je 0x4619d4
lea eax, [ebp - 0x810]
push eax
call fcn.0049899e
pop ecx
push eax
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x840]
call fcn.00402510
lea eax, [ebp - 0x828]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x840]
call fcn.00463912
test eax, eax
jne 0x461a44
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
mov ecx, ebx
cmovae eax, dword [ebp - 0x828]
push eax
push edi
push esi
lea eax, [ebp - 0x870]
push eax
call fcn.00461c72
push eax
lea ecx, [ebp - 0x858]
call fcn.00403f10
xor ebx, ebx
lea ecx, [ebp - 0x870]
push ebx
push 1
call fcn.00402450
jmp 0x461a5b
push 0xffffffffffffffff
xor ebx, ebx
lea eax, [ebp - 0x840]
push ebx
push eax
lea ecx, [ebp - 0x858]
call fcn.00402760
cmp dword [ebp - 0x844], 8
lea eax, [ebp - 0x858]
cmovae eax, dword [ebp - 0x858]
push eax
call fcn.0048f705
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x840]
mov esi, eax
call fcn.00402450
push ebx
push 1
lea ecx, [ebp - 0x858]
call fcn.00402450
push ebx
push 1
lea ecx, [ebp - 0x828]
call fcn.00402450
mov eax, esi
call fcn.004aa360
ret 0xc
Function at 0x461aac
Capabilities:
Read .ini file

Disassembly:
push 0x844
mov eax, 0x5c1871
call fcn.004aa3a5
mov ebx, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x828]
and dword [ebp - 4], 0
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
and dword [ebp - 0x84c], 0
mov dword [ebp - 0x848], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x850], esi
mov dword [ebp - 0x844], eax
call fcn.004023b0
lea eax, [ebp - 0x828]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.00403fb0
cmp byte [ebp + 0x18], 0
mov dword [ebp - 0x84c], 1
jne 0x461b85
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.00486960
lea eax, [ebx + 0xd4]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x461b3b
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push edi
push dword [ebp - 0x844]
push dword [ebp - 0x848]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x810], 0
jne 0x461b69
xor eax, eax
jmp 0x461b76
lea eax, [ebp - 0x810]
push eax
call fcn.0049899e
pop ecx
push eax
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.00402510
lea eax, [ebp - 0x828]
mov ecx, esi
push eax
call fcn.00463912
test eax, eax
jne 0x461bc9
push edi
push dword [ebp - 0x844]
lea eax, [ebp - 0x840]
mov ecx, ebx
push dword [ebp - 0x848]
push eax
call fcn.00461c72
push eax
mov ecx, esi
call fcn.00403f10
push 0
push 1
lea ecx, [ebp - 0x840]
call fcn.00402450
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.00402450
mov eax, esi
call fcn.004aa360
ret 0x14

Function at 0x461cc6
Capabilities:
Read .ini file

Disassembly:
push 0x838
mov eax, 0x5c18a4
call fcn.004aa3a5
mov edi, ecx
mov ecx, dword [ebp + 0xc]
lea eax, [edi + 0x8c]
cmp dword [eax + 0x14], 8
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x844], ecx
jb 0x461cf1
mov eax, dword [eax]
push eax
push dword [ebp + 0x10]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
cmp esi, dword [ebp + 0x10]
jne 0x461dcf
xor esi, esi
mov dword [ebp - 0x814], 7
push esi
xor eax, eax
mov dword [ebp - 0x818], esi
push 0x625f30
lea ecx, [ebp - 0x828]
mov word [ebp - 0x828], ax
call fcn.00402510
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 4], esi
push esi
push eax
call fcn.00486960
push dword [ebp + 0x10]
lea eax, [ebp - 0x810]
push 0x5c66e4
push eax
call fcn.0040ad20
add esp, 0x18
lea eax, [ebp - 0x810]
cmp byte [edi + 5], 0
mov ecx, edi
push eax
push dword [ebp - 0x844]
lea eax, [ebp - 0x840]
push ebx
push eax
je 0x461d84
call fcn.00461be2
jmp 0x461d89
call fcn.00461c9c
push eax
lea ecx, [ebp - 0x828]
call fcn.00403f10
push esi
push 1
lea ecx, [ebp - 0x840]
call fcn.00402450
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.0048f705
pop ecx
push 0
push 1
lea ecx, [ebp - 0x828]
mov esi, eax
call fcn.00402450
mov eax, esi
call fcn.004aa360
ret 0xc
Function at 0x461dd9
Capabilities:
Read .ini file

Disassembly:
push 0x82c
mov eax, 0x5c18ee
call fcn.004aa3a5
mov edi, ecx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp + 0x10]
push 0x800
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x810]
push ecx
push eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], ecx
call fcn.00486960
lea eax, [edi + 0x8c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x461e36
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.004023b0
and dword [ebp - 4], 0
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x834], 1
jb 0x461e7c
mov eax, dword [esi]
jmp 0x461e7e
mov eax, esi
push ebx
push eax
call fcn.0049893c
pop ecx
pop ecx
test eax, eax
jne 0x461eca
cmp byte [edi + 5], 0
lea eax, [ebp - 0x828]
push ebx
push dword [ebp - 0x82c]
mov ecx, edi
push dword [ebp - 0x830]
push eax
je 0x461eae
call fcn.00461be2
jmp 0x461eb3
call fcn.00461c9c
push eax
mov ecx, esi
call fcn.00403f10
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.00402450
mov eax, esi
call fcn.004aa360
ret 0x10
Function at 0x462ae6
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa44
mov eax, dword [0x634274]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
mov edi, ecx
call fcn.00486960
lea eax, [edi + 0x2c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x462b1f
mov eax, dword [eax]
push str.Config
push eax
lea eax, [ebp - 0x20c]
push 0x5c5b7c
push eax
call fcn.0040ad20
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x462b57
lea eax, [ebp - 0x20c]
push eax
call int.00465b8e
pop ecx
push 0x208
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.00486960
push str.UseVestige.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x5c58d8
push eax
call fcn.0040ad20
add esp, 0x1c
cmp word [ebp - 0x414], si
jne 0x462b96
mov eax, esi
jmp 0x462ba3
lea eax, [ebp - 0x414]
push eax
call fcn.0049899e
pop ecx
push eax
lea eax, [ebp - 0x414]
push eax
lea ecx, [edi + 0x8c]
call fcn.00402510
push 0x208
lea eax, [ebp - 0x61c]
push esi
push eax
call fcn.00486960
push str.Cache.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push 0x5c58d8
push eax
call fcn.0040ad20
add esp, 0x1c
cmp word [ebp - 0x61c], si
jne 0x462bf5
mov eax, esi
jmp 0x462c02
lea eax, [ebp - 0x61c]
push eax
call fcn.0049899e
pop ecx
push eax
lea eax, [ebp - 0x61c]
push eax
lea ecx, [edi + 0xa4]
call fcn.00402510
push 0x208
lea eax, [ebp - 0x824]
push esi
push eax
call fcn.00486960
lea eax, [ebp - 0xa44]
push 0x5c6710
push eax
call fcn.004664ed
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x462c43
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x824]
push 0x625fe0
push eax
call fcn.0040ad20
add esp, 0xc
lea ecx, [ebp - 0xa44]
push esi
push 1
call fcn.00402450
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x462c84
lea eax, [ebp - 0x824]
push eax
call int.00465b8e
pop ecx
push 0x208
lea eax, [ebp - 0xa2c]
push esi
push eax
call fcn.00486960
push str.Cache.ini
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0xa2c]
push 0x5c58d8
push eax
call fcn.0040ad20
add esp, 0x1c
cmp word [ebp - 0xa2c], si
je 0x462cce
lea eax, [ebp - 0xa2c]
push eax
call fcn.0049899e
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0xa2c]
push eax
lea ecx, [edi + 0xbc]
call fcn.00402510
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00455afe
mov esp, ebp
pop ebp
ret
Function at 0x4632a2
Capabilities:
Read .ini file

Disassembly:
push 0x23c
mov eax, 0x5c19c0
call fcn.004aa3a5
mov ebx, ecx
call fcn.004617b1
lea edi, [ebx + 0xd4]
push eax
mov ecx, edi
call fcn.004024c0
mov esi, str.SmartCloudWBInfo.ini
push esi
call fcn.0049899e
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00404190
push str.guanf
push 0x5c7508
push str.AppInfo
lea eax, [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.00461c72
and dword [ebp - 4], 0
lea esi, [ebx + 0xec]
lea eax, [ebp - 0x248]
cmp esi, eax
je 0x463318
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00402760
push str.guanf
mov ecx, esi
call fcn.00434330
test eax, eax
jne 0x463394
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00486960
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x463345
mov edi, dword [edi]
push edi
push 0x104
lea eax, [ebp - 0x218]
mov edi, str.guanf
push eax
push edi
push 0x5c7508
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x463376
xor eax, eax
jmp 0x463383
lea eax, [ebp - 0x218]
push eax
call fcn.0049899e
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00402510
jmp 0x463399
mov edi, str.guanf
push edi
mov ecx, esi
call fcn.00434330
test eax, eax
jne 0x46345c
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00486960
add esp, 0xc
lea eax, [ebx + 0x5c]
lea ecx, [ebp - 0x230]
push eax
call fcn.00403fb0
push str.SmartCloudWBInfo.ini
mov byte [ebp - 4], 1
call fcn.0049899e
pop ecx
push eax
push str.SmartCloudWBInfo.ini
lea ecx, [ebp - 0x230]
call fcn.00404190
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
push 0x5c7508
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x46342d
xor eax, eax
jmp 0x46343a
lea eax, [ebp - 0x218]
push eax
call fcn.0049899e
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00402510
push 0
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0
call fcn.00402450
push edi
mov ecx, esi
call fcn.00434330
test eax, eax
jne 0x463498
push edi
push 0x5c7508
push str.AppInfo
lea eax, [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.00461dd9
push eax
mov ecx, esi
call fcn.00403f10
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.00402450
push 0
push 1
lea ecx, [ebp - 0x248]
call fcn.00402450
call fcn.004aa360
ret
Function at 0x465b8e
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.0049899e
mov dword [ebp - 8], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0045566c
push dword [ebp + 8]
mov esi, eax
push esi
mov dword [ebp - 4], esi
call fcn.0049897c
add esp, 0x10
call fcn.004601b3
test al, al
je 0x465be6
sub eax, 0xc4830003
adc al, ch
out 0xa5, al
invalid
mov edx, 0xfae76f40
jp 0x465c48
push esp
pop ecx
nop
invalid
mov eax, dword [ebp - 8]
xor ebx, ebx
xor edi, edi
inc ebx
mov dword [ebp - 0xc], edi
test eax, eax
js 0x465caa
cmp word [esi + edi*2], 0x5c
jne 0x465c9b
call fcn.00460648
test al, al
je 0x465c2e
imul edx, dword ds:[ebp - 0x35], 0xffffffe9
in eax, dx
daa
or bl, byte [esi - 0x2e53e564]
jg 0x465bc2
mov ecx, ebx
add esi, dword [0xb3656ea6]
add byte [edi + 0x7034af1e], 0x8b
jge 0x465c22
outsb dx, byte [esi]
mov bl, 0x82
xchg dword [esi], ebx
scasd eax, dword es:[edi]
xor al, 0x70
mov edi, dword [ebp - 0xc]
call fcn.00460603
test al, al
je 0x465c4a
in eax, dx
mov word [ebp - 0x63], gs
sti
inc esp
iretd
int1
mov esi, dword [ebp - 4]
jne 0x465c46
call fcn.004606d2
test al, al
je 0x465c73
cmp edx, esp
pop es
loopne 0x465c79
pushal
js 0x465c7b
jo 0x465c77
call 0x58d1af74
rol byte [ecx - 0x5e], 0xd9
add ecx, dword [ebx - 0x30]
in al, 0xd
mov bh, 0x87
test al, 0xcb
adc al, 0x8b
jne 0x465c6f
movzx ebx, word [esi + edi*2]
xor eax, eax
push esi
mov word [esi + edi*2], ax
mov dword [esi + edi*2], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x465c94
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x465cba
mov eax, dword [ebp - 8]
mov word [esi + edi*2], bx
inc edi
mov dword [ebp - 0xc], edi
cmp edi, eax
jle 0x465bf9
xor ebx, ebx
inc ebx
push esi
call fcn.00455675
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
jmp 0x465caa

Function at 0x4663c5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x634274]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x63fec4], 0
push ebx
push esi
push edi
je 0x466432
call fcn.004604ef
test al, al
je 0x466403
daa
adc dword [ecx + 0x7e], 0xdbfb2872
scasd eax, dword es:[edi]
jb 0x466398
int 0xaa
cwde
or ah, al
call fcn.004605be
test al, al
jmp 0x4664d7
call fcn.004607e6
test al, al
je 0x46644b
popfd
pop ds
jmp 0x46642d
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00486960
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4664bb
lea eax, [ebp - 0x20c]
push eax
call fcn.00494cf8
lea eax, [ebp - 0x20c]
mov dword [esp], str.config_systemprofile
push eax
call fcn.00487ac0
pop ecx
pop ecx
test eax, eax
jne 0x4664b4
lea eax, [ebp - 0x20c]
push str.documents_and_settingslocalservice
push eax
call fcn.00487ac0
pop ecx
pop ecx
test eax, eax
je 0x4664bb
mov byte [0x63fec4], 1
call fcn.00460534
test al, al
je 0x4664d7
adc byte [edx], bl
mov dword [0x3627824e], eax
enter 0x2ddb, 0x64
daa
shr byte [edx + 0x61247057], cl
Function at 0x46ad09
Capabilities:
Enumerate processes

Disassembly:
push 0x268
mov eax, 0x5c2187
call fcn.004aa3a5
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x26c]
xor ebx, ebx
push 0x22c
push ebx
push eax
mov dword [ebp - 0x270], ebx
call fcn.00486960
add esp, 0xc
lea ecx, [ebp - 0x40]
push esi
call fcn.004023b0
lea eax, [ebp - 0x40]
mov dword [ebp - 4], ebx
push eax
call fcn.0046e6ca
pop ecx
call fcn.004601f8
test al, al
je 0x46ad6b
in al, 0x17
lahf
out 0xa0, al
hlt
call fcn.004607a1
test al, al
je 0x46ad84
push es
in eax, dx
adc dword [edi + 0x5f], edx
test eax, 0x19426f41
leave
bound edi, qword [esi + 0x6af080c5]
add byte [edx + 2], ch
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [ebp - 0x274], edi
cmp edi, 0xffffffff
jne 0x46ada1
xor ebx, ebx
jmp 0x46ae86
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x26c], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x46ae71
call fcn.00460351
test al, al
je 0x46add9
cmpsd dword [esi], dword es:[edi]
out dx, al
adc eax, 0x8bd4e7b9
hlt
call fcn.004602c7
test al, al
je 0x46adff
push esp
popal
into
mov eax, dword [0x86af86bb]
or eax, 0xfaabe96d
cmp ah, 0xac
invalid
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp word [ebp - 0x248], ax
je 0x46ae26
lea eax, [ebp - 0x248]
push eax
call fcn.0049899e
pop ecx
push eax
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x28]
call fcn.00402510
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.0046e6ca
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00463912
lea ecx, [ebp - 0x28]
push 0
push 1
test eax, eax
je 0x46ae9a
mov byte [ebp - 4], 0
call fcn.00402450
lea eax, [ebp - 0x26c]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x46adbd
mov ebx, dword [ebp - 0x270]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.00402450
mov eax, ebx
call fcn.004aa360
ret
xor ebx, ebx
inc ebx
call fcn.00402450
jmp 0x46ae7f
Function at 0x46b5d4
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x24c
mov eax, 0x5c21f2
call fcn.004aa3a5
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
and dword [ebp - 0x250], 0
add byte [ebx + 0x758b0c45], cl
or byte [ebx - 0x24f5b], al
inc dword [eax]
push 0x208
mov dword [ebp - 0x258], eax
lea eax, [ebp - 0x218]
push 0
push eax
mov dword [ebp - 0x24c], esi
call fcn.00486960
add esp, 0xc
call fcn.004600e4
test al, al
je 0x46b631
clc
mov dh, bl
cmpsb byte [esi], byte es:[edi]
mov bh, 0x39
ffree st(4)
jne 0x46b65b
inc esi
or dword [eax - 0x7442ebb6], ebx
mov ch, 0xb4
std
invalid
call fcn.004601b3
test al, al
je 0x46b64e
mov dl, 8
stc
salc
inc eax
in al, 0xfc
mov dl, 0x3d
jno 0x46b5e2
sub ecx, dword ss:[esi + 0x5b]
pop edi
mov al, 0x3a
out dx, al
imul ebp, dword [eax + 4], 1
add byte [eax], al
push 0x104
lea eax, [ebp - 0x218]
xor ebx, ebx
push eax
push ebx
jmp 0x46b78e
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x46b780
call fcn.00460579
test al, al
je 0x46b6a1
mov dword [edi], esi
int1
cmp al, 0x10
cmp al, 0xb0
pushal
invalid
call fcn.0046082b
test al, al
je 0x46b6ca
push edx
je 0x46b6bc
mov ebx, 0x5772d32f
rol ah, 0x7e
test al, 0xe3
mov esp, 0xe014c491
push eax
loopne 0x46b70e
or dh, ch
inc edx
ja 0x46b702
ret 0xb58b
and dword [ebp - 0x220], 0
xor eax, eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
je 0x46b6fa
lea eax, [ebp - 0x218]
push eax
call fcn.0049899e
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402510
and dword [ebp - 4], 0
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push eax
cld
add byte [ebp - 0x22f7b], cl
call dword [eax - 0x73]
test dword [eax + 0x50fffffd], edi
call fcn.0046eb27
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.00402450
cmp dword [ebp - 0x234], 0x10
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push eax
push dword [ebp - 0x258]
call fcn.0046af3e
pop ecx
pop ecx
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
push 0
push 1
call fcn.00460925
mov ebx, dword [ebp - 0x254]
push 0x104
lea eax, [ebp - 0x218]
inc ebx
push eax
push ebx
push esi
mov dword [ebp - 0x254], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x46b662
call fcn.004aa360
ret
Function at 0x46c129
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor eax, eax
push esi
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
call fcn.00460420
test al, al
je 0x46c15f
jmp 0x46c123
call fcn.0046023d
test al, al
je 0x46c17e
cwde
xor al, 0x3d
xchg ecx, eax
test byte [ebx], ch
wait
clc
hlt
call fcn.00460534
test al, al
je 0x46c19c
and ebp, dword [edi]
and dword [edi - 0x491f3db4], 0x3bedb6b1
js 0x46c208
mov ecx, 0xda656d1a
aad 0xe8
or dword [ebx - 1], eax
inc dword [eax + eax*8 + 0x1abc2074]
invalid
call fcn.004604aa
test al, al
je 0x46c1c5
mov esp, 0xd014fe1a
invalid
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 4]
push eax
mov ebx, 0xf013f
push ebx
push 0
push dword [ebp + 0xc]
push reloc.WS2_32.dll_closesocket
call esi
test eax, eax
jne 0x46c343
call fcn.00460534
test al, al
je 0x46c20a
clc
pushfd
loop 0x46c23c
xor eax, 0xac486d11
shl byte [ebx + 0x46907f7e], 0xd6
lcall 0xf01, 0x3fbb25fe
add byte [ebp + 0x5350f845], cl
str word [ebp + 0x5350f845]
lea eax, [ebp - 8]
push eax
push ebx
push 0
push str.SoftWare
push dword [ebp - 4]
call esi
test eax, eax
je 0x46c22d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x46c343
xor esi, esi
lea eax, [ebp - 0xc]
push esi
push eax
push esi
push ebx
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x46c333
call fcn.004606d2
test al, al
je 0x46c276
stosb byte es:[edi], al
inc ebp
or ebp, edi
xchg edx, eax
xchg edi, eax
mov ecx, 0xcd34881d
invalid
call fcn.0046016e
test al, al
je 0x46c295
in eax, dx
jg 0x46c2d3
rol byte [ebx], 0x8d
fimul dword [ebx + edx*4 - 0x4ebf448c]
push edx
sbb eax, 0x9388035
cmp al, 0x3e
inc ebp
push esi
lea eax, [ebp - 0x10]
push eax
push esi
push 0xf013f
push esi
push esi
push esi
push dword [ebp + 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x46c2c0
push dword [ebp - 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
jmp 0x46c339
push dword [ebp + 0x18]
call fcn.0049899e
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0x18]
push 1
sbb byte [edx + 1], ch
push esi
push dword [ebp + 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
push dword [ebp - 0xc]
call ebx
call fcn.004607e6
test al, al
je 0x46c315
lcall 0x9e8e, 0x3a111731
mov al, 0xb3
movsb byte es:[edi], byte [esi]
aad 0x12
pop es
add eax, 0x198f599a
mov byte [edi - 0x30ded15a], ah
pop esp
call fcn.0046009f
test al, al
je 0x46c333
sti
scasd eax, dword es:[edi]
mov bh, byte [ecx - 0x311ba93f]
and byte [edi], ch
ja 0x46c34b
sbb dword [ebp + 0x26], 0x7e90d274
mov al, 0x10
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call esi
push dword [ebp - 4]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46e947
Capabilities:
Check for software breakpoints

Disassembly:
push 0xc
mov eax, 0x5c25e8
call fcn.004aa371
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x14], 0x10
jb 0x46e966
mov eax, dword [eax]
push ecx
push ecx
push 0xffffffffffffffff
push eax
push ecx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ecx, ecx
mov dword [ebp - 0x10], eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0045566c
pop ecx
mov dword [ebp - 0x14], eax
call fcn.004607e6
test al, al
je 0x46e9b4
stc
stosd dword es:[edi], eax
sar byte [edi + 0x4dc4684d], cl
sub dword [edi], edx
pop es
pop ebp
sbb byte [0xbf52199b], 0x2e
invalid
call fcn.0046009f
test al, al
je 0x46e9d2
aaa
popal
in eax, 0x8c
pushal
dec ecx
push esi
cdq
lcall 0x32a4, 0xb6612e36
out dx, eax
outsd dx, dword [esi]
dec ebx
out dx, eax
push 0xc458bb1
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x14], 0x10
jb 0x46e9dd
mov eax, dword [eax]
push dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
push ebx
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [ebp + 8]
push ebx
call fcn.004023b0
and dword [ebp - 4], 0
push ebx
mov dword [ebp - 0x18], 1
inc ebp
call 0x46ea0a
call fcn.00455675
pop ecx
call fcn.00460396
test al, al
je 0x46ea30
popal
pop ebx
pop edi
stosd dword es:[edi], eax
cmp al, 0xcc
leave
xor ecx, dword [esi - 0x61]
push 0x41
mov ebp, esp
jbe 0x46ea03
push esp
lahf
mov edi, 0xc0b2c9cc
call fcn.0046082b
test al, al
je 0x46ea56
std
mov ah, 0x71
pop esi
and byte [ecx - 0x9dca571], 0xe9
xchg edi, eax
invalid
call fcn.004601b3
test al, al
je 0x46ea78
mov ah, 0xb9
retf 0x6982
mov eax, dword [ebp + 8]
call fcn.004aa34b
ret