joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460df5
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 4
lea eax, [ebp - 0xc]
xorps xmm0, xmm0
push eax
push 0xf
push 0x400
movlpd qword [ebp - 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x460e44
or edx, 0xffffffff
mov ecx, 0x4f7d08
call fcn.00462840
push eax
push 4
pop edx
lea ecx, [ebp - 0xc]
call fcn.00460d8d
pop ecx
or edx, 0xffffffff
lea ecx, [ebp - 0xc]
call fcn.00462810
mov ecx, dword [ebp + 8]
sub esp, 0x10
mov edx, dword [ebp + 0xc]
mov esi, esp
mov dword [ebp - 0x94], eax
mov dword [esi], 1
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
call fcn.00468827
push 0x80
mov edi, eax
lea eax, [ebp - 0x90]
push 0
push eax
call fcn.004b8c50
add esp, 0x1c
lea esi, [ebp - 0x90]
mov ecx, edi
call fcn.0045f44c
push 3
xor edx, edx
pop ecx
div ecx
mov ebx, ecx
sub ebx, edx
jmp 0x460ed1
inc edi
mov byte [esi], al
inc esi
cmp byte [edi], 0
je 0x460ec9
cmp ebx, 2
jne 0x460ec9
push dword [ebp - 0x94]
lea edx, [ebp - 0x10]
mov ecx, esi
sub edx, esi
call fcn.00460d3f
pop ecx
push 3
add esi, eax
pop ecx
lea eax, [ebx + 1]
cdq
idiv ecx
mov ebx, edx
mov al, byte [edi]
test al, al
jne 0x460ea3
push 0xffffffffffffffff
mov byte [esi], al
call fcn.0046265e
lea edx, [ebp - 0x90]
mov ecx, eax
call fcn.0045f484
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b7879
leave
ret

Function at 0x460efd
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 4], eax
mulsd xmm1, qword [0x507068]
push ebx
push esi
push edi
addsd xmm1, qword [0x506fb0]
movaps xmm0, xmm1
call fcn.004e5ce0
push ebx
push 0
push 0x64
push edx
push eax
call fcn.004e5b60
mov dword [ebp - 0x10], ebx
pop ebx
push edx
push eax
mov edi, ecx
call fcn.00460df5
pop ecx
pop ecx
push 4
mov esi, eax
xorps xmm0, xmm0
lea eax, [ebp - 0xc]
movlpd qword [ebp - 0xc], xmm0
push eax
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x460f71
push 0x2e
pop eax
mov word [ebp - 0xc], ax
xor eax, eax
mov word [ebp - 0xa], ax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 0x14]
movzx eax, word [ecx]
add ecx, 2
mov byte [edx], al
lea eax, [ebp - 4]
inc edx
cmp ecx, eax
jne 0x460f77
mov ecx, dword [ebp - 0x10]
sub esp, 0x10
mov eax, esp
xor ebx, ebx
sub esp, 0x10
mov dword [eax + 0xc], ecx
lea ecx, [ebp - 0x14]
mov dword [eax], 1
mov dword [eax + 8], edi
mov eax, esp
push 4
pop edx
sub esp, 0x10
mov dword [eax + 0xc], ebx
mov dword [eax + 8], ecx
mov ecx, str._s_s_02d
mov dword [eax], edx
mov eax, esp
mov dword [eax + 0xc], ebx
mov dword [eax], edx
mov dword [eax + 8], esi
call fcn.0046889d
add esp, 0x30
mov esi, eax
mov edx, 0x4f80a8
mov ecx, esi
call fcn.0045f671
test al, al
je 0x460fe7
mov ecx, esi
call fcn.0045f44c
mov byte [eax + esi - 1], bl
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b7879
leave
ret
Function at 0x461c8b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
mov edx, dword [ebp + 8]
mov esi, edi
mov dword [ebp - 4], esi
mov ecx, edi
lea eax, [edx - 1]
sar eax, 1
mov dword [ebp - 8], eax
cmp edi, eax
jge 0x461ce1
lea esi, [ecx + ecx]
lea ecx, [ebx + 8]
lea ecx, [ecx + esi*4]
lea eax, [ecx - 4]
push eax
push ecx
lea ecx, [ebp + 0x10]
call fcn.00461aa2
movzx ecx, al
xor ecx, 1
inc ecx
add ecx, esi
mov eax, dword [ebx + ecx*4]
mov dword [ebx + edi*4], eax
mov edi, ecx
mov eax, dword [ebp - 8]
cmp ecx, eax
jl 0x461cad
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 4]
cmp ecx, eax
jne 0x461cf4
test dl, 1
jne 0x461cf4
mov eax, dword [ebx + edx*4 - 4]
mov dword [ebx + edi*4], eax
lea edi, [edx - 1]
mov eax, dword [ebp + 0x10]
mov dword [ebp + 8], eax
cmp esi, edi
jge 0x461d23
push dword [ebp + 0xc]
lea esi, [edi - 1]
sar esi, 1
lea ecx, [ebp + 8]
lea eax, [ebx + esi*4]
push eax
call fcn.00461aa2
test al, al
je 0x461d23
mov eax, dword [ebx + esi*4]
mov dword [ebx + edi*4], eax
mov edi, esi
cmp dword [ebp - 4], esi
jl 0x461cfe
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x461e14
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x461f0f
cmp byte [edi], 0
je 0x461f0f
test ebx, ebx
jne 0x461e3c
call fcn.0045f44c
mov ebx, eax
mov eax, dword [0x513fb8]
xor ecx, ecx
mov dword [ebp - 8], ecx
mov byte [ebp - 1], cl
test eax, eax
je 0x461e52
cmp eax, 0xffffffff
jne 0x461e84
push ecx
push ecx
push 3
push ecx
push ecx
push 0x40000000
push str..pipeLOCALArsLexis_Logger
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x513fb8], eax
test eax, eax
je 0x461f0f
cmp eax, 0xffffffff
je 0x461f0f
mov byte [ebp - 1], 1
xor ecx, ecx
push ecx
push ecx
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
jne 0x461ea7
push str.logPipe:_SetNamedPipeHandleState___failed_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp byte [ebp - 1], 0
je 0x461ee4
push esi
push 0x4f3608
push str.app:__s_n
call fcn.0045f9ea
pop ecx
pop ecx
mov esi, eax
mov ecx, esi
call fcn.0045f44c
push 0
lea ecx, [ebp - 8]
push ecx
push eax
push esi
push dword [0x513fb8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call fcn.004c5e5a
pop ecx
pop esi
push 0
lea eax, [ebp - 8]
push eax
push ebx
push edi
push dword [0x513fb8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x461f0f
push dword [0x513fb8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x513fb8], 0xffffffff
pop edi
pop ebx
leave
ret
Function at 0x461f14
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push edi
mov edi, ecx
test dl, dl
jne 0x461f43
cmp byte [0x519200], bl
je 0x461f43
cmp dword [0x519208], ebx
je 0x461f43
push ecx
push edi
call fcn.0046051d
test al, al
je 0x461f43
mov byte [ebp - 1], 1
jmp 0x461f67
mov byte [ebp - 1], bl
cmp byte [0x5191ee], bl
jne 0x461f60
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x461f60
cmp byte [0x519202], bl
je 0x461f67
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp byte [0x5191ef], bl
jne 0x4620af
cmp byte [0x519202], bl
je 0x461f9f
mov eax, dword [0x513fb8]
test eax, eax
je 0x4620af
cmp eax, 0xffffffff
je 0x4620af
xor edx, edx
mov ecx, edi
call fcn.00461e14
jmp 0x4620af
push esi
push 0x519ad4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lock inc dword [0x51920c]
mov esi, dword [0x519208]
test esi, esi
jne 0x462006
push 8
call fcn.004b7b0e
pop ecx
push ebx
mov esi, eax
push 0x20000
push ebx
mov dword [esi], 0x4f6844
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 0x34
mov dword [esi + 4], eax
mov dword [0x5191fc], esi
call fcn.004b7b0e
pop ecx
push dword [0x5191fc]
mov ecx, eax
push 0x8000
call fcn.00460364
mov esi, eax
mov dword [0x519208], esi
jmp 0x46201c
cmp dword [esi + 8], 0xfff80
jle 0x46201c
mov ecx, esi
call fcn.0046034a
mov esi, dword [0x519208]
mov ecx, edi
call fcn.0045f44c
cmp byte [ebp - 1], 0
mov ebx, eax
jne 0x46205e
push ebx
push edi
mov ecx, esi
call fcn.00460443
cmp byte [0x519201], 0
je 0x46205e
push 1
call fcn.004bb737
push eax
push ebx
push 1
push edi
call fcn.004cb9c4
push 1
call fcn.004bb737
push eax
call fcn.004c834e
add esp, 0x1c
mov eax, dword [0x519204]
test eax, eax
je 0x462093
push 0x4f31b0
push eax
call fcn.004bb658
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x462093
push esi
push ebx
push 1
push edi
call fcn.004cb9c4
push esi
call fcn.004c834e
push esi
call fcn.004bffa8
add esp, 0x18
mov edx, ebx
mov ecx, edi
call fcn.00461e14
push 0x519ad4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lock dec dword [0x51920c]
pop esi
pop edi
pop ebx
leave
ret

Function at 0x4623fb
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, 0x200
lea eax, [ebp - 0x204]
push ebx
push 0
push eax
mov esi, edx
mov edi, ecx
call fcn.004b8c50
push esi
push edi
push str._s_d_n
lea eax, [ebp - 0x204]
push ebx
push eax
call fcn.0045f8ed
add esp, 0x20
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b7879
leave
ret
Function at 0x4625dd
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push esi
mov esi, edx
xor esi, 0x1505
push edi
mov edi, ecx
cmp edx, 4
jb 0x46261b
push ebx
mov ebx, edx
shr ebx, 2
imul ecx, dword [edi], 0x5bd1e995
sub edx, 4
imul esi, esi, 0x5bd1e995
add edi, 4
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul ecx, eax, 0x5bd1e995
xor esi, ecx
sub ebx, 1
jne 0x4625f4
pop ebx
sub edx, 1
je 0x46263c
sub edx, 1
je 0x462633
sub edx, 1
jne 0x462647
movzx eax, byte [edi + 2]
shl eax, 0x10
xor esi, eax
movzx eax, byte [edi + 1]
shl eax, 8
xor esi, eax
movzx eax, byte [edi]
xor eax, esi
imul esi, eax, 0x5bd1e995
mov eax, esi
shr eax, 0xd
xor eax, esi
imul ecx, eax, 0x5bd1e995
pop edi
pop esi
mov eax, ecx
shr eax, 0xf
xor eax, ecx
ret

Function at 0x4629c9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
or edx, 0xffffffff
call fcn.00462840
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4629e0
xor al, al
ret
shr eax, 4
and al, 1
ret

Function at 0x462eab
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
movsx eax, byte [ecx]
push eax
mov dword [ebp - 4], 0x5c3a3f
call fcn.004c60ac
mov byte [ebp - 4], al
sub al, 0x41
pop ecx
cmp al, 0x19
ja 0x462ee6
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
sub eax, 1
je 0x462ee2
sub eax, 1
je 0x462ee2
sub eax, 3
jne 0x462ee6
mov al, 1
leave
ret
xor al, al
leave
ret

Function at 0x462fd2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
lea eax, [ebp - 0x210]
mov esi, ecx
push 0
push eax
call fcn.004b8c50
add esp, 0xc
lea eax, [ebp - 0x210]
mov edi, 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x46306e
cmp eax, edi
jae 0x46306e
test esi, esi
jne 0x46302b
lea ecx, [ebp - 0x210]
call fcn.004694eb
jmp 0x463070
push 0x208
lea eax, [ebp - 0x418]
push 0
push eax
call fcn.004b8c50
add esp, 0xc
or edx, 0xffffffff
mov ecx, esi
call fcn.00462840
lea ecx, [ebp - 0x418]
push ecx
push 0
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x46306e
lea ecx, [ebp - 0x418]
jmp 0x463024
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004b7879
leave
ret
Function at 0x46311e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, edx
push esi
push edi
test ebx, ebx
mov dword [ebp - 0x18], ebx
mov edi, ecx
sete cl
call fcn.00413f3a
test ebx, ebx
je 0x463252
or edx, 0xffffffff
mov ecx, ebx
call fcn.00462840
push 0x4fe6a4
push eax
call fcn.004bb5fa
mov esi, eax
mov dword [ebp - 0x10], esi
pop ecx
pop ecx
test esi, esi
je 0x463252
push 2
xor ebx, ebx
push ebx
push esi
call fcn.004cc394
add esp, 0xc
test eax, eax
jne 0x46322f
push esi
call fcn.004cc023
pop ecx
xor cl, cl
mov dword [ebp - 4], eax
call fcn.00413f3a
mov eax, dword [ebp - 4]
lea edx, [eax + 3]
cmp eax, edx
ja 0x46322f
mov ecx, dword [ebp + 8]
call fcn.004621fe
mov dword [ebp - 8], eax
test eax, eax
je 0x46322f
push ebx
push ebx
push esi
call fcn.004cc394
add esp, 0xc
test eax, eax
jne 0x46322f
mov eax, dword [ebp - 4]
push esi
push eax
push 1
push dword [ebp - 8]
call fcn.004cc5a7
add esp, 0x10
mov ecx, eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], ecx
push esi
cmp ecx, eax
je 0x463242
call fcn.004cc07f
pop ecx
push esi
mov dword [ebp - 0xc], eax
call fcn.004cc053
pop ecx
mov esi, eax
mov eax, dword [ebp - 4]
push esi
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push eax
push dword [ebp - 0x18]
push str.ReadFileWithAllocator:_fread___failed__path:__s__size:__d__nRead:__d__err:__d__isEof:__d_n
call fcn.004620b3
add esp, 0x18
test esi, esi
jne 0x463215
cmp dword [ebp - 0xc], ebx
jne 0x463215
xor ecx, ecx
inc ecx
jmp 0x463217
mov cl, bl
call fcn.00413f3a
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x463237
push dword [ebp - 8]
call fcn.004c5e5a
pop ecx
mov esi, dword [ebp - 0x10]
mov dword [edi], ebx
mov dword [edi + 4], ebx
push esi
jmp 0x46324a
mov eax, dword [ecx]
mov edx, dword [ebp - 8]
push edx
call dword [eax + 0xc]
jmp 0x46322c
mov edx, dword [ebp - 8]
mov dword [edi], edx
mov dword [edi + 4], eax
call fcn.004bffa8
pop ecx
jmp 0x463259
xor ebx, ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x463260
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, edx
or edx, 0xffffffff
push edi
call fcn.00462840
mov ecx, dword [esi]
xor ebx, ebx
mov edi, dword [esi + 4]
inc ebx
push 0
push 0x80
push 2
push 0
push ebx
push 0x40000000
push eax
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4632a0
xor al, al
jmp 0x4632e6
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
push edi
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
test eax, eax
je 0x4632c5
cmp edi, dword [ebp - 4]
je 0x4632c5
mov cl, bl
jmp 0x4632c7
xor cl, cl
call fcn.00413f3a
cmp dword [ebp - 8], 0
je 0x4632d7
cmp edi, dword [ebp - 4]
je 0x4632d9
xor bl, bl
test esi, esi
je 0x4632e4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4633ca
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, edx
call fcn.004632eb
mov esi, eax
cmp esi, 0xffffffff
jne 0x4633e2
xor edi, edi
jmp 0x463411
push dword [ebp + 8]
push 0
push edi
call fcn.004b8c50
and dword [ebp - 4], 0
lea eax, [ebp - 4]
add esp, 0xc
push 0
push eax
push dword [ebp + 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x46340e
or edi, 0xffffffff
jmp 0x463411
mov edi, dword [ebp - 4]
test esi, esi
je 0x463421
cmp esi, 0xffffffff
je 0x463421
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x463427
Capabilities:
Delete file

Disassembly:
test ecx, ecx
jne 0x46342e
xor al, al
ret
push esi
or edx, 0xffffffff
call fcn.00462840
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 2
neg eax
sbb eax, eax
inc eax
or eax, esi
pop esi
jne 0x46345c
xor ecx, ecx
call fcn.0046448c
jmp 0x46342b
mov al, 1
ret

Function at 0x463623
Capabilities:
Create directory

Disassembly:
or edx, 0xffffffff
call fcn.00462840
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x46363b
mov al, 1
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete al
ret

Function at 0x46364a
Capabilities:
Create directory

Disassembly:
push esi
push edi
mov edi, ecx
call fcn.00462a91
mov esi, eax
mov edx, edi
mov ecx, esi
call fcn.0045f4ee
test al, al
jne 0x463674
mov ecx, esi
call fcn.004635de
test al, al
jne 0x463674
mov ecx, esi
call fcn.0046364a
mov ecx, edi
pop edi
pop esi
jmp fcn.00463623

Function at 0x46367d
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
or edx, 0xffffffff
call fcn.00462840
mov edi, eax
mov ecx, edi
call fcn.0045f463
push 2
lea esi, [eax + 2]
push esi
call fcn.004c7d3d
mov ebx, eax
mov edx, esi
push edi
mov ecx, ebx
mov dword [esp + 0x18], ebx
call fcn.00460d8d
add esp, 0xc
mov dword [esp + 0x14], 3
xor ecx, ecx
mov dword [esp + 0x18], ebx
mov eax, 0x614
mov dword [esp + 0x10], ecx
mov word [esp + 0x20], ax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x26], ecx
mov dword [esp + 0x2a], ecx
mov dword [esp + 0x2e], ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push dword [esp + 0xc]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
call fcn.004c5e5a
pop ecx
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x463cd3
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
call fcn.0046330d
test al, al
jne 0x463ce7
xor eax, eax
jmp 0x463d57
cmp dword [0x51ab6c], 0
mov ebx, 0x51ab70
jne 0x463d3c
push ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor ebx, ebx
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0x51ab90
push ebx
push ebx
push 0x463a98
push ebx
push ebx
mov dword [0x51ab8c], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [0x51ab90]
mov ecx, str.FileWatcherThread
mov dword [0x51ab6c], eax
call fcn.0046fd2d
mov ebx, 0x51ab70
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, edi
mov ecx, esi
call fcn.00463b7d
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x4644ae
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, edx
push ebx
mov ebx, ecx
push esi
push edi
test ebx, ebx
jne 0x4644c6
xor eax, eax
jmp 0x464597
or edx, 0xffffffff
mov ecx, eax
call fcn.00462840
mov ecx, dword [ebp + 8]
mov esi, eax
or edx, 0xffffffff
mov dword [ebp - 0x18], esi
call fcn.00462840
mov dword [ebp - 0xc], eax
xor edi, edi
mov eax, 0x20019
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 4]
push ecx
push eax
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x46455f
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x464556
mov eax, dword [ebp - 8]
shr eax, 1
inc eax
push 2
push eax
call fcn.004c7d3d
pop ecx
pop ecx
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
push esi
push esi
push dword [ebp - 0xc]
mov dword [ebp - 0x10], edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x464556
lea ecx, [ebp - 0x10]
call fcn.0045f778
mov edi, dword [ebp - 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 2
jne 0x464582
cmp ebx, reloc.OLEAUT32.dll_SysReAllocString
jne 0x464582
cmp dword [ebp - 0x14], 0x20019
jne 0x464582
mov esi, dword [ebp - 0x18]
mov eax, 0x20119
jmp 0x4644ea
or edx, 0xffffffff
mov ecx, edi
call fcn.00462810
push edi
mov esi, eax
call fcn.004c5e5a
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4645fd
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov eax, edx
mov dword [ebp - 4], ecx
push esi
push edi
or edx, 0xffffffff
mov dword [ebp - 8], eax
mov ecx, eax
call fcn.00462840
mov ecx, dword [ebp + 8]
or edx, 0xffffffff
mov ebx, eax
call fcn.00462840
mov ecx, dword [ebp + 0xc]
or edx, 0xffffffff
mov edi, eax
call fcn.00462840
mov esi, eax
mov ecx, esi
call fcn.0045f463
lea eax, [eax*2 + 2]
push eax
push esi
mov esi, dword [ebp - 4]
push 1
push edi
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
movzx ecx, bl
push ecx
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.00464724
push eax
push str.WriteRegStr__s___s___s___s_____d_n
call fcn.004620b3
add esp, 0x18
mov al, bl
pop edi
pop esi
pop ebx
leave
ret

Function at 0x464683
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov eax, edx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebp + 0xc]
or edx, 0xffffffff
mov ecx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov dword [ebp + 0xc], edi
call fcn.00462840
mov ecx, dword [ebp + 8]
or edx, 0xffffffff
mov esi, eax
call fcn.00462840
push 4
lea ecx, [ebp + 0xc]
push ecx
push 4
push eax
push esi
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
movzx ecx, bl
push ecx
mov ecx, dword [ebp - 8]
push edi
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.00464724
push eax
push str.WriteRegDWORD__s___s___s___d_____d_n
call fcn.004620b3
add esp, 0x18
mov al, bl
pop edi
pop esi
pop ebx
leave
ret

Function at 0x464799
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
je 0x4647ae
call fcn.00464736
or edx, 0xffffffff
mov ecx, edi
call fcn.00462840
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
movzx ecx, byte [ebp + 8]
mov esi, eax
push esi
push ecx
push edi
mov ecx, ebx
call fcn.00464724
push eax
push str.LoggedDeleteRegKey__s___s___d_____d_n
call fcn.004620b3
add esp, 0x14
test esi, esi
je 0x4647f2
cmp esi, 2
je 0x4647f2
mov ecx, esi
xor bl, bl
call fcn.0046448c
jmp 0x4647f4
mov bl, 1
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret

Function at 0x46482f
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
or edx, 0xffffffff
mov dword [ebp - 4], ebx
mov ecx, edi
call fcn.00462840
mov ecx, dword [ebp + 8]
or edx, 0xffffffff
mov esi, eax
call fcn.00462840
push eax
push esi
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov esi, eax
test esi, esi
je 0x46486c
cmp esi, 2
je 0x46486c
xor bl, bl
jmp 0x46486e
mov bl, 1
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 8]
push edi
call fcn.00464724
push eax
push str.LoggedDeleteRegValue__s___s___s_____d_n
call fcn.004620b3
add esp, 0x14
test bl, bl
jne 0x464894
mov ecx, esi
call fcn.0046448c
pop edi
pop esi
mov al, bl
pop ebx
leave
ret