joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f070
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
lea eax, [ebp - 8]
push eax
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
xor eax, eax
push ebp
push 0x45f0be
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov edx, 0x45f0dc
mov eax, dword [ebp - 8]
call fcn.0045efcc
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f0c5
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret

Function at 0x45f250
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x60], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45f383
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor eax, eax
push ebp
push 0x45f35b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00404f7c
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
movzx eax, word [ebx + 0x18]
mov word [ebp - 0x1c], ax
lea eax, [ebp - 4]
mov edx, dword [ebx + 8]
call fcn.00407e88
lea eax, [ebp - 0x60]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00408cc0
mov eax, dword [ebp - 0x60]
mov edx, 0x45f3a4
call fcn.00408c88
je 0x45f2f2
push 0x45f3a4
push dword [ebp - 4]
push 0x45f3a4
lea eax, [ebp - 4]
mov edx, 3
call fcn.00408bd8
cmp dword [ebx + 0x14], 0
je 0x45f310
push dword [ebp - 4]
push 0x45f3b4
push dword [ebx + 0x14]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00408bd8
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x220
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004088f4
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x45f351
mov eax, dword [ebp - 0x58]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp - 0x54]
mov dword [ebx + 0xc], eax
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45f365
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f38a
lea eax, [ebp - 0x60]
call fcn.00407a60
lea eax, [ebp - 4]
call fcn.00407a60
ret
Function at 0x45f888
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov edi, 0x4ef0cc
mov byte [ebp - 1], 0
xor edx, edx
push ebp
push 0x45fa01
push dword fs:[edx]
mov dword fs:[edx], esp
test esi, esi
jne 0x45f8bd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45fa0b
call fcn.0045f070
push esi
push 0
push 0x100001
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x45f8e5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45fa0b
xor edx, edx
push ebp
push 0x45f9f0
push dword fs:[edx]
mov dword fs:[edx], esp
test bl, bl
je 0x45f9be
push 0x64
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_WaitForInputIdle
push 0
mov eax, edi
mov ecx, 1
mov edx, dword [0x45f7f0]
call fcn.00409de8
add esp, 4
push esi
push 0x45f818
call sub.user32.dll_EnumWindows
mov dword [ebp - 0xc], 0x79
mov eax, dword [edi]
call fcn.00409c34
test eax, eax
je 0x45f9be
mov eax, dword [edi]
call fcn.00409c34
mov esi, eax
dec esi
test esi, esi
jl 0x45f986
inc esi
xor ebx, ebx
push 0
push 0
push 0x10
mov eax, dword [edi]
mov eax, dword [eax + ebx*4]
push eax
call sub.user32.dll_PostMessageW
push 0
push 0
push 0x11
mov eax, dword [edi]
mov eax, dword [eax + ebx*4]
push eax
call sub.user32.dll_PostMessageW
push 0
push 1
push 0x16
mov eax, dword [edi]
mov eax, dword [eax + ebx*4]
push eax
call sub.user32.dll_PostMessageW
inc ebx
dec esi
jne 0x45f94f
push 0x19
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_WaitForSingleObject
push 1
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x45f9b5
mov byte [ebp - 1], 1
call fcn.0040724c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45fa0b
dec dword [ebp - 0xc]
jne 0x45f92f
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
sete byte [ebp - 1]
cmp byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f9f7
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45fff8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov byte [ebp - 1], 7
xor edx, edx
push ebp
push 0x460100
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call sub.kernel32.dll_GetVersionExW
mov eax, dword [ebp - 0x110]
cmp eax, 2
jne 0x4600bb
mov byte [ebp - 1], 5
mov eax, dword [ebp - 0x11c]
cmp eax, 6
jb 0x460097
mov byte [ebp - 1], 0xa
cmp byte [ebp - 6], 1
jne 0x460077
mov eax, dword [ebp - 0x118]
cmp eax, 2
jb 0x460068
mov byte [ebp - 1], 0xe
jmp 0x4600f6
cmp eax, 1
jb 0x4600f6
mov byte [ebp - 1], 0xd
jmp 0x4600f6
mov byte [ebp - 1], 0xb
mov eax, dword [ebp - 0x118]
cmp eax, 2
jb 0x46008c
mov byte [ebp - 1], 0xf
jmp 0x4600f6
cmp eax, 1
jb 0x4600f6
mov byte [ebp - 1], 0xc
jmp 0x4600f6
cmp eax, 5
jb 0x4600f6
mov byte [ebp - 1], 6
cmp dword [ebp - 0x118], 1
jb 0x4600f6
cmp byte [ebp - 6], 1
jne 0x4600b5
mov byte [ebp - 1], 7
jmp 0x4600f6
mov byte [ebp - 1], 9
jmp 0x4600f6
cmp eax, 1
jne 0x4600f2
mov byte [ebp - 1], 1
cmp dword [ebp - 0x11c], 4
jne 0x4600da
cmp dword [ebp - 0x118], 0xa
jne 0x4600da
mov byte [ebp - 1], 2
cmp dword [ebp - 0x11c], 4
jne 0x4600f6
cmp dword [ebp - 0x118], 0x5a
jne 0x4600f6
mov byte [ebp - 1], 3
jmp 0x4600f6
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46010a
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4622c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x462378
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.004620ac
test al, al
je 0x46235a
mov ecx, dword [ebp - 0x1c]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00407be8
mov ebx, dword [ebp - 0x20]
dec ebx
test ebx, ebx
jl 0x46235a
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004088f4
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumValueW
mov eax, dword [ebp - 4]
call fcn.004088f4
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.0040894c
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x462313
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46237f
lea eax, [ebp - 0x2c]
call fcn.00407a60
lea eax, [ebp - 4]
call fcn.00407a60
ret
Function at 0x4624b4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.00461db0
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.004088f4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.00461eb4
test al, al
jne 0x46251c
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4e98fc]
mov dl, 1
mov eax, dword [0x460b84]
call fcn.004238cc
call fcn.00407158
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x462528
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.004088f4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov edx, eax
mov eax, ebx
call fcn.00461eb4
test al, al
jne 0x462589
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4e9bb4]
mov dl, 1
mov eax, dword [0x460b84]
call fcn.004238cc
call fcn.00407158
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00461de0
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x462648
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00407b44
mov eax, dword [ebp - 8]
call fcn.00407b44
xor eax, eax
push ebp
push 0x46275b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor ebx, ebx
mov eax, dword [0x4e96a8]
cmp byte [eax], 0
je 0x4626ae
call fcn.0040beb8
cmp byte [eax + 0x15], 0
je 0x46269b
mov ebx, pe_nt_image_headers32
jmp 0x4626ae
call fcn.0040beb8
cmp byte [eax + 0x14], 0
je 0x4626ae
mov ebx, 0x200
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
or ebx, 0x20006
push ebx
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004088f4
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
push ebx
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x462740
cmp dword [ebp - 8], 0
jne 0x462709
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
test ebx, ebx
sete byte [ebp - 9]
jmp 0x462731
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004088f4
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
test ebx, ebx
sete byte [ebp - 9]
push ebx
call sub.kernel32.dll_SetLastError
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462762
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407ac0
ret
Function at 0x462770
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00407b44
mov eax, dword [ebp - 8]
call fcn.00407b44
xor eax, eax
push ebp
push 0x4628b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [edi], eax
xor ebx, ebx
mov eax, dword [0x4e96a8]
cmp byte [eax], 0
je 0x4627e6
call fcn.0040beb8
cmp byte [eax + 0x15], 0
je 0x4627d3
mov ebx, pe_nt_image_headers32
jmp 0x4627e6
call fcn.0040beb8
cmp byte [eax + 0x14], 0
je 0x4627e6
mov ebx, 0x200
lea eax, [ebp - 0x18]
push eax
or ebx, 0x20019
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.004088f4
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x462895
cmp dword [ebp - 8], 0
jne 0x462817
xor ebx, ebx
jmp 0x462821
mov eax, dword [ebp - 8]
call fcn.004088f4
mov ebx, eax
lea eax, [ebp - 0x20]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x46288c
mov eax, dword [ebp - 0x20]
call fcn.00404568
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x462884
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x46287a
mov eax, dword [ebp - 0x1c]
mov dword [esi], eax
mov eax, dword [ebp - 0x20]
mov dword [edi], eax
mov byte [ebp - 0xd], 1
jmp 0x46288c
mov eax, dword [ebp - 0x1c]
call fcn.00404584
jmp 0x46288c
mov eax, dword [ebp - 0x1c]
call fcn.00404584
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4628b7
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407ac0
ret

Function at 0x462b94
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], ecx
mov ebp, edx
mov edi, eax
xor ebx, ebx
xor esi, esi
mov eax, dword [0x4e96a8]
cmp byte [eax], 0
je 0x462bd8
call fcn.0040beb8
cmp byte [eax + 0x15], 0
je 0x462bc5
mov esi, pe_nt_image_headers32
jmp 0x462bd8
call fcn.0040beb8
cmp byte [eax + 0x14], 0
je 0x462bd8
mov esi, 0x200
lea eax, [esp + 4]
push eax
or esi, 0x20019
push esi
push 0
mov eax, ebp
call fcn.004088f4
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x462c23
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x10]
call fcn.004088f4
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x462c2c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [edi], eax
xor esi, esi
mov eax, dword [0x4e96a8]
cmp byte [eax], 0
je 0x462c7b
call fcn.0040beb8
cmp byte [eax + 0x15], 0
je 0x462c68
mov esi, pe_nt_image_headers32
jmp 0x462c7b
call fcn.0040beb8
cmp byte [eax + 0x14], 0
je 0x462c7b
mov esi, 0x200
lea eax, [ebp - 0x10]
push eax
or esi, 0x20019
push esi
push 0
mov eax, dword [ebp - 8]
call fcn.004088f4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x462cf3
cmp dword [ebp - 0xc], 0
jne 0x462cc0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
jmp 0x462ce1
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.004088f4
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
test bl, bl
je 0x462cea
mov eax, dword [ebp - 0x14]
mov dword [edi], eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x462d70
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, ecx
mov edi, edx
mov esi, eax
mov byte [esp], 0
xor ebx, ebx
mov eax, dword [0x4e96a8]
cmp byte [eax], 0
je 0x462db5
call fcn.0040beb8
cmp byte [eax + 0x15], 0
je 0x462da2
mov ebx, pe_nt_image_headers32
jmp 0x462db5
call fcn.0040beb8
cmp byte [eax + 0x14], 0
je 0x462db5
mov ebx, 0x200
lea eax, [esp + 4]
push eax
or ebx, 0x20006
push ebx
push 0
mov eax, edi
call fcn.004088f4
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
mov ebx, eax
push ebx
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x462dff
mov eax, ebp
call fcn.004088f4
push eax
mov eax, dword [esp + 8]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete byte [esp]
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
movzx eax, byte [esp]
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x462e0c
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [0x4e96a8]
cmp byte [eax], 0
jne 0x462e3e
mov eax, dword [ebp - 8]
call fcn.004088f4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov ebx, eax
jmp 0x462ebf
xor eax, eax
push ebp
push 0x462ea1
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [0x4e96a8]
cmp byte [eax], 0
je 0x462e80
call fcn.0040beb8
cmp byte [eax + 0x15], 0
je 0x462e6d
mov ebx, pe_nt_image_headers32
jmp 0x462e80
call fcn.0040beb8
cmp byte [eax + 0x14], 0
je 0x462e80
mov ebx, 0x200
push 0
push ebx
mov eax, dword [ebp - 8]
call fcn.004088f4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x462ebf
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x462fdc
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 0x11], cl
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4631cc
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 0x10]
mov eax, 0x4631e8
call fcn.00408e6c
test eax, eax
je 0x4631a9
cmp byte [ebp - 0x11], 0
je 0x46319c
xor edx, edx
push ebp
push 0x463192
push dword fs:[edx]
mov dword fs:[edx], esp
xor esi, esi
mov eax, dword [0x4e96a8]
cmp byte [eax], 0
je 0x46306a
call fcn.0040beb8
cmp byte [eax + 0x15], 0
je 0x463057
mov esi, pe_nt_image_headers32
jmp 0x46306a
call fcn.0040beb8
cmp byte [eax + 0x14], 0
je 0x46306a
mov esi, 0x200
lea eax, [ebp - 0x18]
push eax
or esi, 0x2000f
push esi
push 0
mov eax, dword [ebp - 0x10]
call fcn.004088f4
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
xor edx, edx
push ebp
push 0x463181
push dword fs:[edx]
mov dword fs:[edx], esp
test eax, eax
jne 0x463160
xor eax, eax
mov dword [ebp - 0x20], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryInfoKeyW
test eax, eax
jne 0x463160
mov esi, dword [ebp - 0x20]
dec esi
cmp esi, 0
jl 0x463160
mov eax, dword [0x4e7f9c]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x1c]
call fcn.00408a78
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
call fcn.00408018
push eax
push esi
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x463156
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x1c]
call fcn.00408a78
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x10]
call fcn.004248f4
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
call fcn.00408b50
movzx ecx, byte [ebp - 0x11]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00462fdc
test al, al
jne 0x463156
call fcn.0040724c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4631a9
dec esi
cmp esi, 0xffffffff
jne 0x4630da
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463188
lea eax, [ebp - 4]
xor edx, edx
call fcn.00408a78
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00462ec8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4631d3
lea eax, [ebp - 0x24]
call fcn.00407a60
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407ac0
ret
Function at 0x463644
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 8], 0
mov eax, dword [ebp - 4]
add eax, 0x14
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.004088f4
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], ebx
test ebx, ebx
jbe 0x4636f2
xor eax, eax
push ebp
push 0x4636e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404568
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], esi
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, esi
xor ecx, ecx
call fcn.00404f7c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.004088f4
push eax
call sub.version.dll_GetFileVersionInfoW
cmp eax, 1
sbb eax, eax
inc eax
mov edx, dword [ebp - 4]
mov byte [edx + 8], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4636f2
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x463ab4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x463b8a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor esi, esi
push ebp
push 0x463b5d
push dword fs:[esi]
mov dword fs:[esi], esp
test dl, dl
je 0x463b0e
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.004089f0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0041d018
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, 0xfde9
call fcn.00408204
jmp 0x463b1d
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0xfde9
call fcn.004085ac
mov eax, 1
mov edx, dword [ebp - 4]
test edx, edx
je 0x463b2e
sub edx, 4
mov edx, dword [edx]
test edx, edx
jle 0x463b50
mov ecx, 1
imul eax, eax, 0x5517e877
mov ebx, dword [ebp - 4]
movzx ebx, byte [ebx + ecx - 1]
xor eax, dword [ebx*4 + 0x4e7fa0]
inc ecx
dec edx
jne 0x463b37
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x463b67
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463b91
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00407b20
lea eax, [ebp - 4]
call fcn.00407a84
ret
Function at 0x463b9c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x463cbc
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor ecx, ecx
push ebp
push 0x463c8f
push dword fs:[ecx]
mov dword fs:[ecx], esp
test dl, dl
je 0x463c07
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.004089f0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0041d018
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov ecx, 0xfde9
call fcn.00408204
jmp 0x463c16
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0xfde9
call fcn.004085ac
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x463c30
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x463c79
mov esi, 1
push 0
push 0x5517e877
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.0040983c
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi - 1]
mov edx, dword [eax*8 + 0x4e83a4]
mov eax, dword [eax*8 + 0x4e83a0]
xor eax, dword [ebp - 0x18]
xor edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
inc esi
dec ebx
jne 0x463c3b
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x463c99
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463cc3
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00407b20
lea eax, [ebp - 4]
call fcn.00407a84
ret