joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461dd4
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x5bac3d
call fcn.00580e6b
xor ebx, ebx
push ebx
push dword [0x6c8c38]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x461e57
push 0xc
call fcn.005737a7
mov esi, eax
pop ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x461e25
push esi
call fcn.0040850b
mov byte [ebp - 4], 1
lea eax, [esi + 8]
push eax
mov dword [esi + 4], ebx
call fcn.0040850b
mov byte [ebp - 4], bl
jmp 0x461e27
xor esi, esi
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
mov edi, esi
call fcn.004085c5
mov eax, dword [ebp + 8]
lea edi, [esi + 8]
call fcn.004085c5
push ebx
push ebx
push esi
push 0x452f6b
push ebx
push ebx
call fcn.005755cb
add esp, 0x18
mov dword [0x6c8c38], eax
call fcn.00580f43
ret

Function at 0x461e5d
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x5bbf36
call fcn.00580e6b
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x19c
call fcn.005737a7
pop ecx
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x461e8b
call fcn.0041bcb6
jmp 0x461e8d
xor eax, eax
mov byte [ebp - 4], bl
cmp dword [ebp + 0x20], 8
mov esi, dword [ebp + 0xc]
jae 0x461e9c
lea esi, [ebp + 0xc]
lea edx, [eax + 4]
movzx ecx, word [esi]
inc esi
mov word [edx], cx
inc esi
inc edx
inc edx
cmp cx, bx
jne 0x461e9f
mov ecx, dword [ebp + 0x24]
push ebx
push ebx
push eax
push 0x4619e9
push ebx
push ebx
mov dword [eax], ecx
call fcn.005755cb
add esp, 0x18
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea esi, [ebp + 8]
call fcn.00409c0f
call fcn.00580f43
ret

Function at 0x461eda
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x5bac05
call fcn.00580e6b
mov dword [ebp - 4], 1
push 0xc
call fcn.005737a7
mov esi, eax
pop ecx
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 2
xor ebx, ebx
cmp esi, ebx
je 0x461f24
push esi
call fcn.0040850b
mov byte [ebp - 4], 3
lea eax, [esi + 4]
push eax
call fcn.0040850b
mov byte [ebp - 4], 4
mov dword [esi + 8], ebx
mov byte [ebp - 4], 2
jmp 0x461f26
xor esi, esi
mov byte [ebp - 4], 1
lea eax, [ebp + 8]
mov edi, esi
call fcn.004085c5
lea edi, [esi + 4]
lea eax, [ebp + 0xc]
call fcn.004085c5
mov eax, dword [ebp + 0x10]
push ebx
push ebx
push esi
push 0x461a2c
push ebx
push ebx
mov dword [esi + 8], eax
call fcn.005755cb
add esp, 0x18
mov byte [ebp - 4], bl
lea ecx, [ebp + 8]
call fcn.004085a2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004085a2
call fcn.00580f43
ret
Function at 0x461f74
Capabilities:
Create thread

Disassembly:
push 0xc
mov eax, 0x5a9829
call fcn.00580e6b
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor esi, esi
push esi
push dword [0x6c8c5c]
call edi
cmp eax, 0x102
je 0x461fd3
push 0x19c
call fcn.005737a7
pop ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], esi
cmp eax, esi
je 0x461fb4
call fcn.0041bcb6
jmp 0x461fb6
xor eax, eax
or dword [ebp - 4], 0xffffffff
push esi
push esi
push eax
push 0x461d83
push esi
push esi
mov dword [eax], ebx
call fcn.005755cb
add esp, 0x18
mov dword [0x6c8c5c], eax
push 0x493e0
push dword [0x6c8c5c]
call edi
lea eax, [ebp - 0x10]
push eax
push dword [0x6c8c5c]
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
call fcn.00456612
cmp eax, esi
je 0x462011
cmp dword [ebp - 0x10], 1
sete cl
movzx ecx, cl
push ecx
push ebx
mov ecx, eax
call fcn.00462019
mov esi, eax
mov eax, esi
call fcn.00580f43
ret
Function at 0x465e61
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push dword [esp + 0xc]
call fcn.00465d36
mov esi, eax
xor eax, eax
push eax
push eax
push esi
push 0x45b370
push eax
push eax
call fcn.005755cb
add esp, 0x18
mov dword [esi + 0xc], eax
pop esi
pop ecx
ret 4
Function at 0x46ce72
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a64fa
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x6b06f8]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
xor eax, eax
mov ebx, ecx
add ebx, 0x34
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
mov byte [esp + 0x17], 0
sar eax, 2
test eax, eax
jbe 0x46cf77
mov edi, dword [esp + 0x1c]
mov esi, ebx
call fcn.00413946
mov eax, dword [eax]
and dword [esp + 0x18], 0
mov dword [esp + 0x50], 1
lea edi, [esp + 0x18]
mov esi, eax
call fcn.0046c5fd
test eax, eax
jl 0x46cf51
cmp dword [esp + 0x18], 0
je 0x46cf51
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [esp + 0x50], 2
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push edx
push 0
lea edx, [esp + 0x3c]
push edx
lea edx, [esp + 0x30]
push edx
push 1
push 0x400
push 0x6642bc
push 0xa
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x46cf41
mov byte [esp + 0x17], 1
mov byte [esp + 0x50], 1
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
or dword [esp + 0x50], 0xffffffff
lea eax, [esp + 0x18]
push eax
call fcn.004204aa
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
inc dword [esp + 0x1c]
sar eax, 2
cmp dword [esp + 0x1c], eax
jb 0x46cecf
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46cf8e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a7eb4
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push ebx
push esi
push edi
mov eax, dword [0x6b06f8]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
push 0x41bb4a
push 0x46c62e
xor edi, edi
inc edi
push edi
push 0x10
lea eax, [esp + 0x64]
push eax
mov byte [esp + 0x27], 0
call fcn.00576296
xor esi, esi
mov dword [esp + 0x80], esi
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [esp + 0x24]
push eax
call ebx
mov byte [esp + 0x80], 1
lea eax, [esp + 0x24]
push eax
call ebx
lea eax, [esp + 0x44]
push eax
call ebx
mov byte [esp + 0x80], 2
mov eax, 0x400c
mov word [esp + 0x44], ax
lea eax, [esp + 0x24]
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
cmp eax, esi
jge 0x46d039
push eax
call fcn.004b0f10
mov dword [esp + 0x40], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x18], esi
mov esi, dword [ebp + 8]
add esi, 0x34
lea eax, [esp + 0x54]
mov dword [esp + 0x34], eax
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
mov dword [esp + 0x3c], edi
sar eax, 2
mov dword [esp + 0x1c], esi
test eax, eax
jbe 0x46d135
jmp 0x46d070
mov esi, eax
mov edi, dword [esp + 0x18]
call fcn.00413946
mov eax, dword [eax]
and dword [esp + 0x14], 0
mov byte [esp + 0x80], 4
lea edi, [esp + 0x14]
mov esi, eax
call fcn.0046c5fd
test eax, eax
jl 0x46d108
cmp dword [esp + 0x14], 0
je 0x46d108
lea eax, [esp + 0x64]
push eax
call ebx
mov byte [esp + 0x80], 5
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push edx
push 0
lea edx, [esp + 0x6c]
push edx
lea edx, [esp + 0x40]
push edx
push 1
push 0x400
push 0x6642bc
push 0xb
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x46d0f5
cmp word [esp + 0x24], 0xb
jne 0x46d0f0
cmp word [esp + 0x2c], 0xffff
jne 0x46d0f0
mov eax, dword [ebp + 0xc]
mov byte [eax], 1
mov byte [esp + 0x13], 1
mov byte [esp + 0x80], 4
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [esp + 0x80], 2
lea eax, [esp + 0x14]
push eax
call fcn.004204aa
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x10]
sub ecx, dword [eax + 0xc]
inc dword [esp + 0x18]
sar ecx, 2
cmp dword [esp + 0x18], ecx
jb 0x46d06e
mov byte [esp + 0x80], 1
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [esp + 0x44]
push eax
call esi
mov byte [esp + 0x80], 0
lea eax, [esp + 0x24]
push eax
call esi
or dword [esp + 0x80], 0xffffffff
push 0x41bb4a
push 1
push 0x10
lea eax, [esp + 0x60]
push eax
call fcn.005749c8
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x46d18d
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a64fa
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x6b06f8]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
xor eax, eax
mov ebx, ecx
add ebx, 0x34
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
mov byte [esp + 0x17], 0
sar eax, 2
test eax, eax
jbe 0x46d292
mov edi, dword [esp + 0x1c]
mov esi, ebx
call fcn.00413946
mov eax, dword [eax]
and dword [esp + 0x18], 0
mov dword [esp + 0x50], 1
lea edi, [esp + 0x18]
mov esi, eax
call fcn.0046c5fd
test eax, eax
jl 0x46d26c
cmp dword [esp + 0x18], 0
je 0x46d26c
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [esp + 0x50], 2
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push edx
push 0
lea edx, [esp + 0x3c]
push edx
lea edx, [esp + 0x30]
push edx
push 1
push 0x400
push 0x6642bc
push 7
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x46d25c
mov byte [esp + 0x17], 1
mov byte [esp + 0x50], 1
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
or dword [esp + 0x50], 0xffffffff
lea eax, [esp + 0x18]
push eax
call fcn.004204aa
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
inc dword [esp + 0x1c]
sar eax, 2
cmp dword [esp + 0x1c], eax
jb 0x46d1ea
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46d404
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a643c
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x6b06f8]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
push 0x41bb4a
push 0x46c62e
xor esi, esi
inc esi
push esi
push 0x10
lea eax, [esp + 0x44]
push eax
mov byte [esp + 0x2b], 0
call fcn.00576296
xor eax, eax
mov dword [esp + 0x60], eax
mov ebx, dword [ebp + 8]
push 3
pop ecx
mov word [esp + 0x34], cx
xor ecx, ecx
cmp byte [ebp + 0xc], al
mov dword [esp + 0x30], eax
sete cl
add ebx, 0x34
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x3c], ecx
sar eax, 2
lea ecx, [esp + 0x34]
mov dword [esp + 0x24], ecx
test eax, eax
jbe 0x46d53d
mov edi, dword [esp + 0x1c]
mov esi, ebx
call fcn.00413946
mov eax, dword [eax]
and dword [esp + 0x18], 0
mov byte [esp + 0x60], 2
lea edi, [esp + 0x18]
mov esi, eax
call fcn.0046c5fd
test eax, eax
jl 0x46d517
cmp dword [esp + 0x18], 0
je 0x46d517
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [esp + 0x60], 3
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push edx
push 0
lea edx, [esp + 0x4c]
push edx
lea edx, [esp + 0x30]
push edx
push 1
push 0x400
push 0x6642bc
push 6
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x46d507
mov byte [esp + 0x17], 1
mov byte [esp + 0x60], 2
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [esp + 0x60], 0
lea eax, [esp + 0x18]
push eax
call fcn.004204aa
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
inc dword [esp + 0x1c]
sar eax, 2
cmp dword [esp + 0x1c], eax
jb 0x46d498
or dword [esp + 0x60], 0xffffffff
push 0x41bb4a
push 1
push 0x10
lea eax, [esp + 0x40]
push eax
call fcn.005749c8
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x46daea
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a643c
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x6b06f8]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
push 0x41bb4a
push 0x46c62e
xor esi, esi
inc esi
push esi
push 0x10
lea eax, [esp + 0x44]
push eax
mov byte [esp + 0x2b], 0
call fcn.00576296
xor eax, eax
mov dword [esp + 0x60], eax
mov ebx, dword [ebp + 8]
add ebx, 0x34
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
push 3
pop ecx
mov word [esp + 0x34], cx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x3c], ecx
sar eax, 2
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x24], ecx
test eax, eax
jbe 0x46dc1e
mov edi, dword [esp + 0x1c]
mov esi, ebx
call fcn.00413946
mov eax, dword [eax]
and dword [esp + 0x18], 0
mov byte [esp + 0x60], 2
lea edi, [esp + 0x18]
mov esi, eax
call fcn.0046c5fd
test eax, eax
jl 0x46dbf8
cmp dword [esp + 0x18], 0
je 0x46dbf8
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [esp + 0x60], 3
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push edx
push 0
lea edx, [esp + 0x4c]
push edx
lea edx, [esp + 0x30]
push edx
push 1
push 0x400
push 0x6642bc
push 0xf
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x46dbe8
mov byte [esp + 0x17], 1
mov byte [esp + 0x60], 2
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [esp + 0x60], 0
lea eax, [esp + 0x18]
push eax
call fcn.004204aa
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
inc dword [esp + 0x1c]
sar eax, 2
cmp dword [esp + 0x1c], eax
jb 0x46db79
or dword [esp + 0x60], 0xffffffff
push 0x41bb4a
push 1
push 0x10
lea eax, [esp + 0x40]
push eax
call fcn.005749c8
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x46dc4f
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a643c
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x6b06f8]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
push 0x41bb4a
push 0x46c62e
xor esi, esi
inc esi
push esi
push 0x10
lea eax, [esp + 0x44]
push eax
mov byte [esp + 0x2b], 0
call fcn.00576296
xor eax, eax
mov dword [esp + 0x60], eax
mov ebx, dword [ebp + 8]
add ebx, 0x34
mov dword [esp + 0x3c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
push 3
pop ecx
mov word [esp + 0x34], cx
sar eax, 2
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x24], ecx
test eax, eax
jbe 0x46dd80
mov edi, dword [esp + 0x1c]
mov esi, ebx
call fcn.00413946
mov eax, dword [eax]
and dword [esp + 0x18], 0
mov byte [esp + 0x60], 2
lea edi, [esp + 0x18]
mov esi, eax
call fcn.0046c5fd
test eax, eax
jl 0x46dd5a
cmp dword [esp + 0x18], 0
je 0x46dd5a
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [esp + 0x60], 3
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push edx
push 0
lea edx, [esp + 0x4c]
push edx
lea edx, [esp + 0x30]
push edx
push 1
push 0x400
push 0x6642bc
push 0x10
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x46dd4a
mov byte [esp + 0x17], 1
mov byte [esp + 0x60], 2
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [esp + 0x60], 0
lea eax, [esp + 0x18]
push eax
call fcn.004204aa
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
inc dword [esp + 0x1c]
sar eax, 2
cmp dword [esp + 0x1c], eax
jb 0x46dcdb
or dword [esp + 0x60], 0xffffffff
push 0x41bb4a
push 1
push 0x10
lea eax, [esp + 0x40]
push eax
call fcn.005749c8
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46e006
Capabilities:
Delete registry key

Disassembly:
push ebp
sub esp, 0x290
lea ebp, [esp - 4]
mov eax, dword [0x6b06f8]
xor eax, ebp
mov dword [ebp + 0x290], eax
push 0x3c
mov eax, 0x5b03d5
call fcn.00580e9e
mov eax, dword [0x6c8d7c]
push 0x104
lea ecx, [ebp + 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x46e216
xor edi, edi
mov dword [ebp - 4], edi
lea eax, [ebp + 0x38]
push eax
lea esi, [ebp]
call fcn.004081bb
mov byte [ebp - 4], 1
push 1
mov eax, esi
call fcn.0046e6e6
cmp eax, 0xffffffff
je 0x46e207
mov ecx, dword [ebp + 0x14]
dec ecx
push ecx
inc eax
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, esi
push eax
call fcn.004083b1
mov byte [ebp - 4], 2
push 0xffffffffffffffff
push edi
mov ecx, esi
call fcn.00409936
mov byte [ebp - 4], 1
push edi
push 1
lea esi, [ebp - 0x2c]
call fcn.00409c0f
lea eax, [ebp + 0x240]
push eax
push 0x671f78
call fcn.0041d648
pop ecx
pop ecx
mov ebx, str.AppID_
push ebx
lea esi, [ebp - 0x2c]
call fcn.004081bb
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x240]
push ecx
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.0044978c
add esp, 0xc
mov byte [ebp - 4], 5
push edi
push 1
call fcn.00409c0f
mov eax, dword [ebp + 0x20]
cmp dword [ebp + 0x29c], edi
je 0x46e129
cmp dword [ebp + 0x34], 8
jae 0x46e0f7
lea eax, [ebp + 0x20]
push eax
mov esi, str.VibraniumService
mov ecx, esi
mov edi, 0x670fd0
call fcn.0046e662
pop ecx
cmp dword [ebp + 0x34], 8
mov eax, dword [ebp + 0x20]
jae 0x46e116
lea eax, [ebp + 0x20]
push esi
push str.LocalService
push eax
call fcn.0046e6cc
add esp, 0xc
xor edi, edi
jmp 0x46e13e
cmp dword [ebp + 0x34], 8
jae 0x46e132
lea eax, [ebp + 0x20]
push eax
push closesocket
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push ebx
lea esi, [ebp - 0x48]
call fcn.004081bb
mov byte [ebp - 4], 6
lea ecx, [ebp]
push ecx
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0040ddaf
add esp, 0xc
mov byte [ebp - 4], 7
push 0xffffffffffffffff
push edi
lea ecx, [ebp + 0x1c]
call fcn.00409936
mov byte [ebp - 4], 6
push edi
push 1
lea esi, [ebp - 0x2c]
call fcn.00409c0f
mov byte [ebp - 4], 5
push edi
push 1
lea esi, [ebp - 0x48]
call fcn.00409c0f
mov eax, dword [ebp + 0x20]
cmp dword [ebp + 0x29c], edi
je 0x46e1d0
cmp dword [ebp + 0x34], 8
jae 0x46e19d
lea eax, [ebp + 0x20]
push eax
mov ecx, 0x670fd0
mov edi, ecx
call fcn.0046e662
pop ecx
cmp dword [ebp + 0x34], 8
mov eax, dword [ebp + 0x20]
jae 0x46e1b7
lea eax, [ebp + 0x20]
lea ecx, [ebp + 0x240]
push ecx
push str.AppID
push eax
call fcn.0046e6cc
add esp, 0xc
xor edi, edi
jmp 0x46e1e5
cmp dword [ebp + 0x34], 8
jae 0x46e1d9
lea eax, [ebp + 0x20]
push eax
push closesocket
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov byte [ebp - 4], 1
push edi
push 1
lea esi, [ebp + 0x1c]
call fcn.00409c0f
mov byte [ebp - 4], 0
push edi
push 1
lea esi, [ebp]
call fcn.00409c0f
xor eax, eax
jmp 0x46e21b
mov byte [ebp - 4], 0
push edi
push 1
lea esi, [ebp]
call fcn.00409c0f
mov eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x290]
xor ecx, ebp
call fcn.0057372c
add ebp, 0x294
leave
ret
Function at 0x46e537
Capabilities:
Delete registry key

Disassembly:
push ebp
sub esp, 0x70
lea ebp, [esp - 4]
mov eax, dword [0x6b06f8]
xor eax, ebp
mov dword [ebp + 0x70], eax
push 0x3c
mov eax, 0x5b0338
call fcn.00580e9e
mov eax, dword [ebp + 0x7c]
lea ecx, [ebp + 0x20]
push ecx
push eax
call fcn.0041d648
pop ecx
pop ecx
mov dword [ebp], 0x80004005
xor ebx, ebx
mov dword [ebp - 4], ebx
push str.CLSID_
lea esi, [ebp - 0x2c]
call fcn.004081bb
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x20]
push ecx
push eax
lea eax, [ebp + 4]
push eax
call fcn.0044978c
add esp, 0xc
mov byte [ebp - 4], 3
push ebx
push 1
call fcn.00409c0f
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x46e5aa
lea eax, [ebp + 8]
push eax
push closesocket
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
call edi
cmp eax, ebx
jne 0x46e626
push str.AppID_
lea esi, [ebp - 0x48]
call fcn.004081bb
mov byte [ebp - 4], 4
lea ecx, [ebp + 0x20]
push ecx
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0044978c
add esp, 0xc
mov byte [ebp - 4], 5
push 0xffffffffffffffff
push ebx
lea ecx, [ebp + 4]
call fcn.00409936
mov byte [ebp - 4], 4
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.00409c0f
mov byte [ebp - 4], 3
push ebx
push 1
lea esi, [ebp - 0x48]
call fcn.00409c0f
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x46e617
lea eax, [ebp + 8]
push eax
push closesocket
call edi
cmp eax, ebx
jne 0x46e626
mov dword [ebp], ebx
mov byte [ebp - 4], bl
push ebx
push 1
lea esi, [ebp + 4]
call fcn.00409c0f
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x70]
xor ecx, ebp
call fcn.0057372c
add ebp, 0x74
leave
ret

Function at 0x46e760
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x5b02d0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x6b06f8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x1c]
mov eax, dword [0x6c7718]
mov edx, dword [eax + 0xc]
mov ecx, 0x6c7718
call edx
add eax, 0x10
mov dword [edi], eax
mov dword [esp + 0x14], 0
test esi, esi
je 0x46e7ca
test esi, 0xffff0000
jne 0x46e7ce
movzx esi, si
push esi
call fcn.00402e8e
add esp, 4
test eax, eax
je 0x46e7eb
push esi
push eax
push edi
call fcn.0040cde1
jmp 0x46e7eb
xor eax, eax
jmp 0x46e7e2
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46e7d3
sub eax, edx
sar eax, 1
push eax
push esi
mov eax, edi
call fcn.0040b33c
mov dword [esp + 0x14], 1
mov eax, dword [edi]
push eax
mov dword [edi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [edi + 4], eax
mov dword [esp + 0x14], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4