joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461b99
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
cmp eax, 3
jne 0x461c10
xor eax, eax
mov dword [ebp - 0xc], esi
lea edi, [ebp - 8]
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceExW]
test eax, eax
je 0x461c10
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
shrd ecx, eax, 0x14
shr eax, 0x14
mov dword [ebp - 8], eax
and dword [ebp - 8], 0x80000000
and eax, 0x7fffffff
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], esi
fild qword [ebp - 0x14]
fild qword [ebp - 0xc]
fchs
faddp st(1)
fmul qword [0x4ef288]
fcomp qword [0x4ef280]
fnstsw ax
test ah, 1
jne 0x461c10
inc esi
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x461f5d
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x4d27dc
call fcn.004cdff0
sub esp, 0x5c
mov eax, dword [0x50c868]
push esi
push edi
mov ecx, 0x50c868
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push str._stop__uninstall
push dword [ebp + 8]
xor esi, esi
push 0x4ec558
lea eax, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.00408eea
push 0x40
lea eax, [ebp - 0x64]
push esi
push eax
call fcn.00489f10
xor eax, eax
mov dword [ebp - 0x24], esi
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
add esp, 0x18
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 0x10]
mov dword [ebp - 0x68], 0x44
push esi
mov dword [ebp - 0x3c], 1
mov word [ebp - 0x38], si
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x24]
cmp eax, esi
je 0x462000
cmp dword [ebp - 0x14], esi
je 0x461ffa
cmp ebx, esi
je 0x461ffa
mov dword [ebx], eax
jmp 0x462000
push eax
call edi
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x20], esi
je 0x46200d
push dword [ebp - 0x20]
call edi
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00407fe5
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x462029
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x4d226f
call fcn.004cdff0
sub esp, 0x218
push ebx
push esi
push edi
xor ebx, ebx
push 0x206
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x222]
push ebx
mov dword [ebp - 0x18], ebx
push eax
mov word [ebp - 0x224], bx
call fcn.00489f10
mov esi, dword [ebp + 8]
mov edi, 0x50c868
add esp, 0xc
mov ecx, edi
call fcn.004082b2
mov dword [ebp - 4], ebx
mov eax, dword [0x50c868]
xor esi, esi
inc esi
mov ecx, edi
mov dword [ebp - 0x18], esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], esi
call fcn.0040826f
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], ebx
jne 0x4620ab
lea ecx, [ebp - 0x10]
call fcn.004085ba
lea eax, [ebp - 0x1c]
push str.ressrcchsuplive.svr
push eax
lea ecx, [ebp - 0x10]
call fcn.0040b01a
pop ecx
pop ecx
lea edi, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00407526
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.00407fe5
mov esi, dword [ebp - 0x14]
push esi
push 0x208
lea eax, [ebp - 0x224]
push eax
push 0x4e6a7c
push str.TryNo
push str.common
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
test eax, eax
je 0x462111
lea eax, [ebp - 0x224]
push eax
push dword [ebp + 8]
call fcn.0040849e
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00407fe5
lea eax, [esi - 0x10]
call fcn.00407fe5
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x46227a
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push 0x40000000
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x46229f
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x4622c8
push ebx
push edi
push 0x24
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
cmp ebx, esi
jne 0x4622cb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop edi
pop ebx
pop esi
leave
ret
push 6
pop ecx
xor eax, eax
mov dword [ebp - 0x3c], esi
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x3c]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x462303
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
call esi
push ebx
call esi
mov eax, edi
jmp 0x4622c6
push 6
xor eax, eax
pop ecx
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x20], esi
rep stosd dword es:[edi], eax
xor edi, edi
cmp edi, dword [ebp + 0xc]
jge 0x462341
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x462339
cmp dword [ebp - 0x1c], 1
je 0x462341
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
add edi, 0x64
jmp 0x462312
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4622bb
Function at 0x462897
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4d1d09
call fcn.004cdff0
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edi
call fcn.0046b593
lea esi, [ebp - 0x14]
call fcn.0046b5de
mov eax, dword [eax]
push 1
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 0x10]
call fcn.00454ada
mov ebx, eax
mov eax, dword [ebp - 0x14]
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
call fcn.00407fe5
test bl, bl
je 0x4628ed
cmp dword [ebp - 0x10], edi
jmp 0x4629b6
mov eax, dword [0x50c868]
mov ecx, 0x50c868
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0x4e69ec
lea ebx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00408525
test eax, eax
mov esi, dword [ebp - 0x14]
je 0x4629aa
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4629aa
mov ebx, dword [ebp + 8]
lea edi, [ebx + 0x53c]
lea eax, [ebp - 0x14]
call fcn.00407526
xor edi, edi
inc edi
mov eax, ebx
mov dword [ebx + 0x948], edi
call fcn.00464574
test eax, eax
je 0x46296b
lea eax, [esi - 0x10]
call fcn.00407fe5
cmp dword [ebp - 0x10], 0
je 0x462967
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x4629c4
push 3
mov ecx, ebx
call fcn.00464d4d
cmp eax, edi
je 0x462950
xor edi, edi
push edi
push edi
push dword [ebx + 0x948]
push 3
call fcn.0045a6ab
mov ecx, eax
call fcn.0045a7a8
lea eax, [esi - 0x10]
call fcn.00407fe5
cmp dword [ebp - 0x10], edi
je 0x4629a6
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4629c4
lea eax, [esi - 0x10]
call fcn.00407fe5
cmp dword [ebp - 0x10], 0
je 0x4629c1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x463312
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
inc ebx
push ebx
add esi, 0x24
push ebx
mov eax, esi
call fcn.00465548
xor edi, edi
push edi
push 0x64
mov eax, esi
call fcn.0042d5a2
push edi
push 0xc8
mov eax, esi
call fcn.0042d5a2
push edi
push 0x12c
mov eax, esi
call fcn.0042d5a2
push ebx
push 0x190
mov eax, esi
call fcn.0042d5a2
push dword [ebp + 8]
call fcn.0046433b
push edi
push str.SOFTWARE_sysoptasst
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [ebp - 4]
mov dword [ebp - 4], edi
call fcn.00454ada
test eax, eax
je 0x4633a0
cmp dword [ebp - 4], edi
mov dword [ebp - 8], ebx
je 0x4633ae
push 4
lea eax, [ebp - 8]
push eax
push 4
push edi
push str.is_boot_start
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 4], edi
je 0x4633ae
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 8]
cmp dword [esi + 0x944], 0x24f
jne 0x4633dd
call fcn.0044e29a
mov eax, dword [eax]
test eax, eax
jg 0x4633dd
call fcn.0046b593
cmp dword [eax + 0x1c], edi
je 0x4633dd
lea eax, [esi + 0x950]
call fcn.00469e0f
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 4

Function at 0x463a13
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x12c
mov esi, eax
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
push ebx
lea edi, [esi + 0x24]
push 0x64
mov eax, edi
call fcn.0042d5a2
push 1
push 0xc8
mov eax, edi
call fcn.0042d5a2
push ebx
call fcn.004641b2
push ebx
push 1
mov eax, edi
call fcn.00465548
push ebx
push ebx
push esi
push 0x4639f9
push ebx
push ebx
call fcn.0048eb1f
add esp, 0x18
pop edi
mov dword [esi + 0x93c], eax
pop esi
pop ebx
ret

Function at 0x463e90
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push dword [edi]
lea esi, [ebp - 4]
call fcn.00459198
mov eax, dword [ebp - 4]
pop ecx
add eax, 0xfffffff0
call fcn.00407fe5
mov eax, dword [edi]
push 3
pop esi
cmp dword [eax - 0xc], esi
jl 0x463f51
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x463ed3
push dword [edi]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 1
je 0x463f51
mov ecx, esi
lea edx, [ebp - 4]
mov eax, edi
call fcn.00408bc7
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
cmp eax, esi
mov eax, dword [ebp - 4]
setne bl
add eax, 0xfffffff0
call fcn.00407fe5
test bl, bl
je 0x463f00
push 2
pop eax
jmp 0x463f54
push edi
call fcn.00463e04
test eax, eax
pop ecx
je 0x463f0f
mov eax, esi
jmp 0x463f54
mov ecx, esi
lea edx, [ebp - 4]
mov eax, edi
call fcn.00408bc7
push dword [eax]
call fcn.00461b99
mov ebx, eax
mov eax, dword [ebp - 4]
neg ebx
sbb bl, bl
pop ecx
add eax, 0xfffffff0
inc bl
call fcn.00407fe5
test bl, bl
je 0x463f3e
push 4
jmp 0x463efd
mov eax, dword [edi]
cmp dword [eax - 0xc], 0x96
jle 0x463f4d
push 5
jmp 0x463efd
xor eax, eax
jmp 0x463f54
xor eax, eax
inc eax
pop esi
pop ebx
leave
ret
Function at 0x463f58
Capabilities:
Get common file path
Set current directory

Disassembly:
mov eax, 0x4d31cd
call fcn.004cdff0
sub esp, 0x444
push ebx
push esi
push edi
xor ebx, ebx
push 0x206
lea eax, [ebp - 0x44e]
push ebx
push eax
mov word [ebp - 0x450], bx
call fcn.00489f10
add esp, 0xc
lea eax, [ebp - 0x450]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
push 0x11
push dword [edi + 4]
mov dword [ebp - 0x18], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, dword [0x50c868]
mov ecx, 0x50c868
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push 0x105
lea esi, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.00408130
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], ebx
jge 0x463fe5
push 0x80070057
call fcn.00408113
mov esi, 0x4ed120
mov dword [eax - 0xc], ebx
push esi
mov word [eax], bx
call fcn.0048a91e
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x10]
call fcn.00408058
mov eax, dword [edi + 4]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x10]
mov dword [ebp - 0x38], eax
call fcn.0040deca
mov dword [ebp - 0x34], eax
xor esi, esi
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x30], 0x4ed12c
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov ebx, eax
cmp ebx, esi
je 0x4640fe
push 0x206
lea eax, [ebp - 0x246]
push esi
push eax
mov word [ebp - 0x248], si
call fcn.00489f10
add esp, 0xc
lea eax, [ebp - 0x248]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov eax, dword [0x50c868]
mov ecx, 0x50c868
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x248]
push eax
lea esi, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00459198
pop ecx
mov byte [ebp - 4], 2
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x14]
call fcn.00408f7c
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.00407fe5
mov eax, dword [edi + 0x94c]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x14]
call fcn.00408f7c
mov esi, dword [ebp - 0x14]
push esi
push dword [edi + 0x514]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea edi, [ebp - 0x14]
call fcn.00463e90
push 0
push eax
mov eax, dword [ebp + 8]
push 0x46c
push dword [eax + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [esi - 0x10]
call fcn.00407fe5
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00407fe5
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x46425f
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, eax
and dword [esi + 0x544], 0
cmp dword [esp + 8], 0x61
je 0x464277
cmp dword [esp + 8], 0x41
jne 0x4642ab
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x4642ab
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0
push 0xb1
add esi, 0x514
push dword [esi]
call edi
push 0
push 0
push 0xb7
push dword [esi]
call edi
pop edi
pop esi
ret 4

Function at 0x4642af
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x4d27dc
call fcn.004cdff0
push ecx
mov eax, dword [0x50c868]
push esi
push edi
mov ecx, 0x50c868
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
push 0x105
lea esi, [ebp - 0x10]
call fcn.00408130
push 0x104
push eax
push dword [ebx + 0x514]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esi, dword [ebp - 0x10]
test esi, esi
jne 0x4642fd
xor eax, eax
jmp 0x464304
push esi
call fcn.0048a91e
pop ecx
lea edx, [ebp - 0x10]
call fcn.004080e0
lea edi, [ebp - 0x10]
call fcn.00463e90
push 0
push eax
push 0x46c
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [esi - 0x10]
call fcn.00407fe5
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret
Function at 0x467418
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x4d1658
call fcn.004cdff0
sub esp, 0x418
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
call dword [0x5070b4]
xor esi, esi
mov dword [ebp - 0x20], esi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x424], esi
push 2
push esi
push dword [ebp + 0xc]
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
mov ebx, eax
cmp ebx, esi
mov dword [ebp - 0x14], ebx
jne 0x467470
call fcn.00468a4b
mov esi, eax
jmp 0x467571
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x46748d
call fcn.00468a4b
jmp 0x467566
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
cmp eax, esi
mov dword [ebp + 0xc], eax
je 0x467483
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
cmp eax, edi
mov dword [ebp + 8], edi
jae 0x4674d3
lea eax, [ebp - 0x420]
cmp dword [ebp - 0x424], eax
je 0x4674c9
lea eax, [ebp - 0x424]
call fcn.00468436
mov eax, 0x8007000e
jmp 0x46758c
push 2
push eax
mov byte [ebp - 4], 2
call fcn.0046759d
cmp eax, 0x400
pop ecx
pop ecx
jbe 0x4674f7
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.004683be
jmp 0x467503
lea eax, [ebp - 0x420]
mov dword [ebp - 0x424], eax
mov dword [ebp - 4], 1
jmp 0x46751e
mov ebx, dword [ebp - 0x424]
cmp ebx, esi
jne 0x46752f
mov esi, 0x8007000e
jmp 0x467568
call dword [0x5070b4]
push edi
push ebx
push edi
push dword [ebp + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
cmp eax, esi
je 0x467483
mov ecx, dword [ebp - 0x424]
push dword [ebp + 0x18]
mov word [ecx + eax*2], si
mov ecx, dword [ebp - 0x424]
lea edx, [ebp - 0x1c]
call fcn.004675c2
mov esi, eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
lea eax, [ebp - 0x420]
cmp dword [ebp - 0x424], eax
je 0x46758a
lea eax, [ebp - 0x424]
call fcn.00468436
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x14
Function at 0x4683df
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x4683f2
push 0x80004005
call fcn.00408113
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x4683f9
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push 7
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4684b4
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
push edi
push 0x2001f
push dword [ebp + 8]
mov ebx, ecx
push dword [ebx]
xor esi, esi
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
call fcn.00433728
mov edi, eax
cmp edi, esi
je 0x4684f1
cmp dword [ebp - 8], esi
je 0x4684ed
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x46855e
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x46850f
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 8]
call fcn.004684b4
cmp eax, esi
mov dword [ebp - 0x10], eax
jne 0x468565
lea eax, [ebp - 0x18]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x21c]
push eax
push esi
push dword [ebp - 8]
mov dword [ebp - 0xc], 0x100
call edi
test eax, eax
je 0x4684f9
cmp dword [ebp - 8], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x468545
push dword [ebp - 8]
call edi
mov dword [ebp - 8], esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [ebp - 8], esi
mov ebx, eax
je 0x46855c
push dword [ebp - 8]
call edi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4
cmp dword [ebp - 8], esi
je 0x468573
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
jmp 0x46855e
Function at 0x468f70
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4d21e6
call fcn.004cdff0
sub esp, 0xc
push ebx
push esi
push dword [ebp + 0x10]
lea eax, [ebp - 0x18]
push eax
mov ebx, ecx
call fcn.0040826f
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.0040826f
push dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
mov byte [ebp - 4], 1
call fcn.0040826f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.004690a3
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
call fcn.00407fe5
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00407fe5
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00407fe5
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], esi
jne 0x46900d
add eax, 0xfffffff0
call fcn.00407fe5
xor al, al
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
mov eax, dword [0x50c868]
push edi
mov ecx, 0x50c868
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp + 0x10], edi
mov eax, ebx
mov byte [ebp - 4], 7
call fcn.0045472a
test eax, eax
jbe 0x469082
lea eax, [ebp - 0x10]
lea edi, [ebp + 0x10]
call fcn.00407526
mov eax, edi
push eax
call fcn.0040ab33
pop ecx
mov eax, ebx
call fcn.0045472a
cmp esi, eax
jb 0x469054
call fcn.0048990e
mov eax, dword [ebx + 4]
lea eax, [eax + esi*4]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
lea eax, [ebp + 0x10]
call fcn.00408f7c
mov edi, dword [ebp + 0x10]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x469086
mov eax, ebx
inc esi
call fcn.0045472a
cmp esi, eax
jb 0x469030
mov bl, 1
jmp 0x469088
xor bl, bl
lea eax, [edi - 0x10]
call fcn.00407fe5
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00407fe5
mov al, bl
pop edi
jmp 0x468ffd

Function at 0x46a55c
Capabilities:
Delete file

Disassembly:
mov eax, 0x4d3b9d
call fcn.004cdff0
sub esp, 0x10
mov eax, dword [0x50c868]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov ecx, 0x50c868
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
call fcn.0046a619
mov ebx, eax
test ebx, ebx
jne 0x46a5ad
mov dword [esi + 0x1c], 1
mov esi, dword [ebp - 0x18]
jmp 0x46a5fd
push 0x28
call fcn.0043e7d0
test eax, eax
pop ecx
je 0x46a5c1
push eax
call fcn.0044e589
jmp 0x46a5c3
xor eax, eax
test eax, eax
mov esi, eax
je 0x46a5fd
push dword [ebp + 0xc]
mov ecx, dword [eax]
push dword [ebp - 0x10]
push ebx
push eax
call dword [ecx]
test eax, eax
je 0x46a5f6
xor esi, esi
lea eax, [edi - 0x10]
call fcn.00407fe5
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
mov dword [ebp - 0x14], 1
cmp dword [edi - 0xc], 0
je 0x46a60a
push edi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test esi, esi
je 0x46a614
mov eax, dword [esi]
push esi
call dword [eax + 0xc]
mov esi, dword [ebp - 0x14]
jmp 0x46a5db
Function at 0x46a6fa
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push edi
xor edi, edi
push 0x206
lea eax, [ebp - 0x20a]
push edi
push eax
mov dword [ebp - 4], edi
mov word [ebp - 0x20c], di
call fcn.00489f10
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x400000
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x46a7a2
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
push edi
push eax
push edi
push 2
push edi
push ebx
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingW]
cmp ebx, edi
mov dword [esi], eax
je 0x46a79b
push dword [esi + 8]
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
cmp eax, edi
mov dword [esi + 4], eax
je 0x46a79b
mov dword [ebp - 4], 1
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret