joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438bce
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x220
mov eax, 0x46a439
call fcn.00463278
mov esi, dword [ebp + 8]
mov dword [ebp - 0x228], ecx
mov ecx, esi
call dword [0x471964]
xor ebx, ebx
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x220], ebx
call dword [0x471490]
lea ecx, [ebp - 0x214]
mov dword [ebp - 4], ebx
call dword [0x471964]
lea eax, [ebp - 0x224]
push eax
push 1
push ebx
push str.SOFTWARETencentTraveler
push 0x80000002
mov dword [ebp - 0x224], ebx
call dword [0x47100c]
cmp eax, ebx
jne 0x438ca4
push 0x200
lea eax, [ebp - 0x210]
push ebx
push eax
mov dword [ebp - 0x21c], ebx
call fcn.00463358
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x21c]
push eax
push ebx
push 0x480b00
push dword [ebp - 0x224]
mov dword [ebp - 0x218], 0x200
call dword [0x471008]
cmp eax, ebx
jne 0x438c98
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x214]
call dword [0x471ad8]
push dword [ebp - 0x224]
call dword [0x471004]
lea ecx, [ebp - 0x214]
call dword [0x4714b4]
test al, al
je 0x438d2e
push str.TTraveler.exe
lea ecx, [ebp - 0x218]
call dword [0x4715f8]
mov ecx, dword [ebp - 0x228]
lea eax, [ebp - 0x22c]
push eax
mov byte [ebp - 4], 1
call fcn.0043897c
lea ecx, [ebp - 0x218]
push ecx
push eax
lea eax, [ebp - 0x21c]
push eax
mov byte [ebp - 4], 2
call fcn.00409ebe
add esp, 0xc
push eax
lea ecx, [ebp - 0x214]
mov byte [ebp - 4], 3
call dword [0x471498]
lea ecx, [ebp - 0x21c]
call dword [0x471494]
lea ecx, [ebp - 0x22c]
call dword [0x471494]
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], bl
call dword [0x471494]
lea ecx, [ebp - 0x214]
call dword [0x4714b4]
test al, al
jne 0x438d8b
lea ecx, [ebp - 0x214]
call dword [0x4714a0]
push eax
call dword [0x4712a4]
cmp eax, 0xffffffff
je 0x438d7d
cmp eax, 0x10
je 0x438d7d
cmp eax, 0x800
je 0x438d7d
lea eax, [ebp - 0x214]
push eax
mov ecx, esi
call dword [0x471498]
mov dword [ebp - 0x220], 1
jmp 0x438d8b
mov ecx, esi
call dword [0x471964]
mov dword [ebp - 0x220], ebx
lea ecx, [ebp - 0x214]
call dword [0x471494]
mov eax, dword [ebp - 0x220]
call fcn.004632fb
ret 4
Function at 0x438da5
Capabilities:
Create process on windows

Disassembly:
push 0x1c
mov eax, 0x46a4b2
call fcn.0046320f
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.0040ab4d
mov ecx, eax
call fcn.0040ab53
mov ecx, eax
call fcn.00413987
push str.wClickURLCount
lea ecx, [ebp - 0x20]
mov esi, eax
call dword [sym.imp.AuCommon.dll_public:_void___thiscall_CTXBSTR::constructor_wchar_t_const__]
mov ecx, eax
mov byte [ebp - 4], 1
call dword [sym.imp.AuCommon.dll_public:_wchar_t____thiscall_CTXBSTR::operator_wchar_t__void_const]
push eax
mov ecx, esi
call fcn.00426b34
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], bl
call dword [sym.imp.AuCommon.dll_public:_void___thiscall_CTXBSTR::destructor_void_]
push 1
push 2
lea ecx, [ebp - 0x24]
call dword [0x471978]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 2
call fcn.00409ebe
add esp, 0xc
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 4
call dword [0x471494]
mov esi, 0x480b58
push esi
lea ecx, [ebp - 0x20]
call dword [0x4715f8]
push esi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call dword [0x4715f8]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 6
call fcn.00409ebe
lea ecx, [ebp - 0x20]
push ecx
push eax
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 7
call fcn.00409ebe
add esp, 0x18
lea ecx, [ebp - 0x28]
call dword [0x471494]
lea ecx, [ebp - 0x1c]
call dword [0x471494]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xb
call dword [0x471494]
push ebx
push str.mailto:
lea ecx, [ebp + 0xc]
call dword [0x471958]
test eax, eax
jl 0x438ec2
push dword [ebp + 0x10]
lea ecx, [ebp + 0xc]
push ebx
push ebx
call dword [0x4714a0]
push eax
push str.open
push dword [ebp + 8]
call dword [0x471d20]
jmp 0x438f33
lea ecx, [ebp - 0x10]
call dword [0x471490]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xc
call dword [0x471964]
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
call fcn.00438bce
test eax, eax
mov esi, dword [0x471d20]
mov edi, str.open
je 0x438f15
push dword [ebp + 0x10]
lea ecx, [ebp - 0x14]
push ebx
call dword [0x4714a0]
push eax
lea ecx, [ebp - 0x10]
call dword [0x4714a0]
push eax
push edi
push dword [ebp + 8]
call esi
cmp eax, 0x20
jg 0x438f2a
push dword [ebp + 0x10]
lea ecx, [ebp + 0xc]
push ebx
push ebx
call dword [0x4714a0]
push eax
push edi
push dword [ebp + 8]
call esi
lea ecx, [ebp - 0x10]
call dword [0x471494]
lea ecx, [ebp - 0x14]
call dword [0x471494]
lea ecx, [ebp - 0x18]
call dword [0x471494]
lea ecx, [ebp + 0xc]
call dword [0x471494]
call fcn.004632e7
ret 0xc
Function at 0x456c2b
Capabilities:
Get common file path

Disassembly:
push 0x21c
mov eax, 0x46e478
call fcn.00463278
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x206
lea eax, [ebp - 0x216]
push ebx
mov dword [ebp - 0x224], ebx
push eax
mov word [ebp - 0x218], bx
call fcn.00463358
add esp, 0xc
push 0x472700
lea ecx, [ebp - 0x21c]
call dword [0x4714c4]
lea ecx, [ebp - 0x224]
mov dword [ebp - 4], ebx
call dword [0x471490]
push 1
push 0x1a
lea eax, [ebp - 0x218]
push eax
push ebx
mov byte [ebp - 4], 1
call dword [0x471d18]
test eax, eax
je 0x456cae
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call dword [0x4714e8]
lea ecx, [ebp - 0x21c]
call dword [0x4714b4]
test al, al
je 0x456cd7
push 0x475670
lea ecx, [ebp - 0x224]
call dword [0x4714e8]
lea eax, [ebp - 0x224]
jmp 0x456d32
push 1
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x21c]
call dword [0x4714b0]
mov esi, 0x47e5b8
push esi
mov ecx, eax
mov byte [ebp - 4], 2
call dword [0x4715ac]
test eax, eax
lea ecx, [ebp - 0x228]
setne byte [ebp - 0x21d]
mov byte [ebp - 4], 1
call dword [0x471494]
cmp byte [ebp - 0x21d], bl
je 0x456d2c
push esi
lea ecx, [ebp - 0x21c]
call dword [0x4714a4]
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call dword [0x4714a8]
lea ecx, [ebp - 0x224]
call dword [0x471494]
lea ecx, [ebp - 0x21c]
call dword [0x471494]
mov eax, edi
call fcn.004632fb
ret

Function at 0x45e100
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
call dword [0x4714c0]
cmp dword [ebp + 0x10], 0
mov dword [ebp - 4], eax
jne 0x45e12f
cdq
and edx, 3
add eax, edx
sar eax, 2
add eax, 1
lea eax, [eax + eax*2]
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
mov ecx, esi
call dword [0x4714a0]
mov dword [ebp - 8], eax
xor eax, eax
xor ebx, ebx
xor edi, edi
cmp dword [ebp - 4], eax
jle 0x45e1f3
jmp 0x45e150
xor esi, esi
xor edx, edx
cmp eax, dword [ebp - 4]
jge 0x45e1ad
mov ecx, dword [ebp - 8]
movzx ecx, word [ecx + eax*2]
add eax, 1
shl edx, 6
cmp ecx, 0x60
jle 0x45e172
add ecx, 0xffffffb9
or edx, ecx
jmp 0x45e1a3
cmp ecx, 0x40
jle 0x45e17e
add ecx, 0xffffffbf
or edx, ecx
jmp 0x45e1a3
cmp ecx, 0x3d
jne 0x45e188
add edi, 1
jmp 0x45e1a3
cmp ecx, 0x2f
jle 0x45e194
add ecx, 4
or edx, ecx
jmp 0x45e1a3
jne 0x45e19b
or edx, 0x3f
jmp 0x45e1a3
cmp ecx, 0x2b
jne 0x45e1a3
or edx, 0x3e
add esi, 1
cmp esi, 4
jne 0x45e154
jmp 0x45e1b2
cmp esi, 4
jne 0x45e1ea
lea ecx, [ebx + 3]
mov esi, ecx
sub esi, edi
cmp esi, dword [ebp + 0x10]
jg 0x45e1fc
cmp ecx, ebx
je 0x45e1e1
sub ecx, 1
test edi, edi
je 0x45e1d4
mov esi, ebx
sub esi, edi
add esi, 3
cmp ecx, esi
jge 0x45e1da
mov esi, dword [ebp + 0xc]
mov byte [ecx + esi], dl
shr edx, 8
cmp ecx, ebx
jne 0x45e1c2
mov edx, 3
sub edx, edi
add ebx, edx
cmp eax, dword [ebp - 4]
jl 0x45e150
pop edi
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45ee70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46f744
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x4ab368]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
push 0x206
lea eax, [ebp - 0x216]
push 0
mov dword [ebp - 0x220], 0
push eax
mov word [ebp - 0x218], 0
call fcn.00463358
add esp, 0xc
push 0x472700
lea ecx, [ebp - 0x21c]
call dword [0x4714c4]
lea ecx, [ebp - 0x220]
mov dword [ebp - 4], 0
call dword [0x471490]
push 1
push 0x1a
lea ecx, [ebp - 0x218]
push ecx
push 0
mov byte [ebp - 4], 1
call dword [0x471d18]
test eax, eax
je 0x45ef1b
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x21c]
call dword [0x4714e8]
lea ecx, [ebp - 0x21c]
call dword [0x4714b4]
test al, al
je 0x45ef45
push 0x475670
lea ecx, [ebp - 0x220]
call dword [0x4714e8]
lea eax, [ebp - 0x220]
push eax
jmp 0x45ef9c
push 1
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x21c]
call dword [0x4714b0]
push 0x47e5b8
mov ecx, eax
mov byte [ebp - 4], 2
call dword [0x4715ac]
test eax, eax
lea ecx, [ebp - 0x224]
setne bl
mov byte [ebp - 4], 1
call dword [0x471494]
test bl, bl
je 0x45ef95
push 0x47e5b8
lea ecx, [ebp - 0x21c]
call dword [0x4714a4]
lea edx, [ebp - 0x21c]
push edx
mov ecx, edi
call dword [0x4714a8]
lea ecx, [ebp - 0x220]
call dword [0x471494]
lea ecx, [ebp - 0x21c]
call dword [0x471494]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00463200
mov esp, ebp
pop ebp
ret
Function at 0x45f470
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46f832
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x4ab368]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
mov eax, dword [0x471c20]
mov dword [ebp - 0x10], 1
mov ecx, dword [eax]
cmp ecx, 1
mov dword [ebp - 0x14], ecx
jle 0x45f566
mov edx, dword [0x471c1c]
mov ebx, dword [edx]
add ebx, 4
mov esi, dword [ebx]
movzx eax, word [esi]
cmp ax, 0x2d
je 0x45f4d4
cmp ax, 0x2f
jne 0x45f552
add esi, 2
mov ecx, 0x472b04
mov eax, esi
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x45f506
test dx, dx
je 0x45f502
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x45f506
add eax, 4
add ecx, 4
test dx, dx
jne 0x45f4e0
xor eax, eax
jmp 0x45f50b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x45f5b5
mov ecx, 0x472acc
mov eax, esi
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x45f546
test dx, dx
je 0x45f542
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x45f546
add eax, 4
add ecx, 4
test dx, dx
jne 0x45f520
xor eax, eax
jmp 0x45f54b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x45f5b5
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
add eax, 1
add ebx, 4
cmp eax, ecx
mov dword [ebp - 0x10], eax
jl 0x45f4c3
lea eax, [ebp - 0x14]
push eax
call fcn.0045ed60
push str.BinQQ.exe
push eax
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], 0
call fcn.00409f29
add esp, 0x10
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call dword [0x471494]
lea ecx, [ebp - 0x10]
call dword [0x4714a0]
push eax
call dword [0x471d28]
test eax, eax
mov esi, dword [ebp + 8]
mov ecx, esi
je 0x45f5d4
push 0x472b04
jmp 0x45f5d9
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
call dword [0x4714c4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x472acc
call dword [0x4714c4]
lea ecx, [ebp - 0x10]
call dword [0x471494]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45fe70
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov byte [esp + 0x13], 1
mov ebp, 1
lea edi, [esi + 0xc]
xor ebx, ebx
jmp 0x45fe90
cmp dword [edi + 0x18], 8
mov eax, dword [esi + 0x20]
mov dword [esp + 0x1c], eax
jb 0x45fea2
mov eax, dword [edi + 4]
jmp 0x45fea5
lea eax, [edi + 4]
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esi + 4]
push ebx
push ebx
push ebx
lea edx, [esp + 0x2c]
push edx
push eax
mov eax, dword [esi + 8]
push eax
call fcn.00460e80
push eax
call dword [0x471018]
cmp eax, 0x103
je 0x45ff2f
cmp eax, 0xea
jne 0x45ff94
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x30]
push ecx
mov ecx, dword [esi + 4]
lea edx, [esp + 0x30]
push edx
push ebx
push ebx
push ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
call fcn.00460e80
push eax
call dword [0x471014]
cmp eax, ebx
jne 0x45ff57
cmp dword [esp + 0x14], ebx
je 0x45ff2f
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x45ff75
push ebx
add eax, 1
push eax
mov ecx, edi
call dword [0x471b50]
add ebp, 1
cmp ebp, 3
jle 0x45fe90
jmp 0x45ff38
mov byte [esp + 0x13], bl
cmp ebp, 3
jle 0x45ffb6
push 1
push str.CRegSubKeyIteratorImpl::GetNextItem__
lea ecx, [esp + 0x30]
call fcn.00460fb0
push 0x49808c
lea eax, [esp + 0x2c]
push eax
call fcn.00463572
push eax
push str.CRegSubKeyIteratorImpl::GetNextItem__
lea ecx, [esp + 0x30]
call fcn.00460fb0
push 0x49808c
lea eax, [esp + 0x2c]
push eax
call fcn.00463572
push 1
push str.CRegSubKeyIteratorImpl::GetNextItem__
lea ecx, [esp + 0x30]
call fcn.00460fb0
push 0x49808c
lea ecx, [esp + 0x2c]
push ecx
call fcn.00463572
cmp eax, ebx
je 0x45ff33
push eax
push 0x48bc4c
lea ecx, [esp + 0x30]
call fcn.00460fb0
push 0x49808c
lea edx, [esp + 0x2c]
push edx
call fcn.00463572
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
Function at 0x460260
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov byte [esp + 0x13], 1
mov dword [esp + 0x18], 1
lea edi, [esi + 0x48]
lea ebx, [esi + 0xc]
lea ebp, [esi + 0x28]
nop
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x3c]
add ecx, ecx
mov dword [esp + 0x24], eax
mov eax, 8
mov dword [edi], ecx
cmp dword [ebp + 0x18], eax
jb 0x46029d
mov ecx, dword [ebp + 4]
jmp 0x4602a0
lea ecx, [ebp + 4]
cmp dword [ebx + 0x18], eax
jb 0x4602aa
mov eax, dword [ebx + 4]
jmp 0x4602ad
lea eax, [ebx + 4]
push edi
push ecx
lea ecx, [esi + 0x44]
push ecx
mov ecx, dword [esi + 4]
push 0
lea edx, [esp + 0x34]
push edx
push eax
mov eax, dword [esi + 8]
push eax
call fcn.00460e80
push eax
call dword [0x47101c]
cmp eax, 0x103
je 0x460374
cmp eax, 0xea
jne 0x4603e2
xor eax, eax
push eax
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esi + 4]
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x40], eax
call fcn.00460e80
push eax
call dword [0x471014]
test eax, eax
jne 0x4603a5
cmp dword [esp + 0x1c], eax
je 0x460374
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4603c3
cmp dword [esp + 0x14], 0
je 0x4603c3
add eax, 1
push eax
mov ecx, ebx
call dword [0x471b48]
mov edx, dword [esp + 0x14]
add edx, 1
shr edx, 1
add edx, 1
push edx
mov ecx, ebp
call dword [0x471b48]
mov eax, dword [esp + 0x18]
add eax, 1
cmp eax, 3
mov dword [esp + 0x18], eax
jle 0x460280
jmp 0x460386
mov byte [esp + 0x13], 0
mov dword [edi], 0
cmp dword [esp + 0x18], 3
jle 0x460404
push 1
push 0x48bd38
lea ecx, [esp + 0x30]
call fcn.00460fb0
push 0x49808c
lea eax, [esp + 0x2c]
push eax
call fcn.00463572
push eax
push 0x48bd38
lea ecx, [esp + 0x30]
call fcn.00460fb0
push 0x49808c
lea eax, [esp + 0x2c]
push eax
call fcn.00463572
push 1
push 0x48bd38
lea ecx, [esp + 0x30]
call fcn.00460fb0
push 0x49808c
lea ecx, [esp + 0x2c]
push ecx
call fcn.00463572
test eax, eax
je 0x46037f
push eax
push 0x48bd38
lea ecx, [esp + 0x30]
call fcn.00460fb0
push 0x49808c
lea edx, [esp + 0x2c]
push edx
call fcn.00463572
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
Function at 0x460265
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov byte [esp + 0x13], 1
mov dword [esp + 0x18], 1
lea edi, [esi + 0x48]
lea ebx, [esi + 0xc]
lea ebp, [esi + 0x28]
nop
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x3c]
add ecx, ecx
mov dword [esp + 0x24], eax
mov eax, 8
mov dword [edi], ecx
cmp dword [ebp + 0x18], eax
jb 0x46029d
mov ecx, dword [ebp + 4]
jmp 0x4602a0
lea ecx, [ebp + 4]
cmp dword [ebx + 0x18], eax
jb 0x4602aa
mov eax, dword [ebx + 4]
jmp 0x4602ad
lea eax, [ebx + 4]
push edi
push ecx
lea ecx, [esi + 0x44]
push ecx
mov ecx, dword [esi + 4]
push 0
lea edx, [esp + 0x34]
push edx
push eax
mov eax, dword [esi + 8]
push eax
call fcn.00460e80
push eax
call dword [0x47101c]
cmp eax, 0x103
je 0x460374
cmp eax, 0xea
jne 0x4603e2
xor eax, eax
push eax
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esi + 4]
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x40], eax
call fcn.00460e80
push eax
call dword [0x471014]
test eax, eax
jne 0x4603a5
cmp dword [esp + 0x1c], eax
je 0x460374
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4603c3
cmp dword [esp + 0x14], 0
je 0x4603c3
add eax, 1
push eax
mov ecx, ebx
call dword [0x471b48]
mov edx, dword [esp + 0x14]
add edx, 1
shr edx, 1
add edx, 1
push edx
mov ecx, ebp
call dword [0x471b48]
mov eax, dword [esp + 0x18]
add eax, 1
cmp eax, 3
mov dword [esp + 0x18], eax
jle 0x460280
jmp 0x460386
mov byte [esp + 0x13], 0
mov dword [edi], 0
cmp dword [esp + 0x18], 3
jle 0x460404
push 1
push 0x48bd38
lea ecx, [esp + 0x30]
call fcn.00460fb0
push 0x49808c
lea eax, [esp + 0x2c]
push eax
call fcn.00463572
push eax
push 0x48bd38
lea ecx, [esp + 0x30]
call fcn.00460fb0
push 0x49808c
lea eax, [esp + 0x2c]
push eax
call fcn.00463572
push 1
push 0x48bd38
lea ecx, [esp + 0x30]
call fcn.00460fb0
push 0x49808c
lea ecx, [esp + 0x2c]
push ecx
call fcn.00463572
test eax, eax
je 0x46037f
push eax
push 0x48bd38
lea ecx, [esp + 0x30]
call fcn.00460fb0
push 0x49808c
lea edx, [esp + 0x2c]
push edx
call fcn.00463572
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret

Function at 0x4611d0
Capabilities:
Delete registry key

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [ecx]
sub esp, 0x24
push eax
call fcn.00460e80
push eax
call dword [0x471020]
test eax, eax
je 0x461208
push eax
push str.CRegistryKey::DeleteKey__
lea ecx, [esp + 8]
call fcn.00460fb0
push 0x49808c
lea ecx, [esp + 4]
push ecx
call fcn.00463572
add esp, 0x24
ret 4
Function at 0x461310
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x40]
xor ebp, ebp
lea eax, [esp + 0x10]
push eax
mov esi, ecx
push ebp
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esi]
push ebp
push edi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], ebp
call fcn.00460e80
mov ebx, dword [0x471008]
push eax
call ebx
cmp eax, ebp
je 0x461366
push eax
push str.CRegistryKey::QueryValue__
lea ecx, [esp + 0x20]
call fcn.00460fb0
push 0x49808c
lea edx, [esp + 0x1c]
push edx
call fcn.00463572
mov eax, dword [esp + 0x14]
cmp eax, 2
je 0x461380
cmp eax, 1
je 0x461380
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x2c
ret 8
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x44]
shr eax, 1
push eax
mov ecx, ebp
call dword [0x471b48]
cmp dword [ebp + 0x18], 8
jb 0x46139e
mov eax, dword [ebp + 4]
jmp 0x4613a1
lea eax, [ebp + 4]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esi]
push eax
lea edx, [esp + 0x1c]
push edx
push 0
push edi
call fcn.00460e80
push eax
call ebx
test eax, eax
je 0x4613db
push eax
push str.CRegistryKey::QueryValue__
lea ecx, [esp + 0x20]
call fcn.00460fb0
push 0x49808c
lea eax, [esp + 0x1c]
push eax
call fcn.00463572
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x2c
ret 8

Function at 0x4613f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x28
push ebx
push esi
push edi
mov edi, dword [esp + 0x38]
lea eax, [esp + 0xc]
push eax
mov esi, ecx
push 0
lea ecx, [esp + 0x40]
push ecx
mov ecx, dword [esi]
push 0
push edi
mov dword [esp + 0x20], 0
call fcn.00460e80
mov ebx, dword [0x471008]
push eax
call ebx
test eax, eax
je 0x461445
push eax
push str.CRegistryKey::QueryValue__
lea ecx, [esp + 0x18]
call fcn.00460fb0
push 0x49808c
lea edx, [esp + 0x14]
push edx
call fcn.00463572
mov eax, dword [esp + 0x38]
cmp eax, 4
je 0x46145e
cmp eax, 5
je 0x46145e
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x28
ret 8
cmp dword [esp + 0xc], 4
je 0x461484
push 0
push str.CRegistryKey::QueryValue__
lea ecx, [esp + 0x18]
call fcn.00460fb0
push 0x49808c
lea eax, [esp + 0x14]
push eax
call fcn.00463572
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esi]
push edx
lea eax, [esp + 0x40]
push eax
push 0
push edi
call fcn.00460e80
push eax
call ebx
test eax, eax
je 0x4614c2
push eax
push str.CRegistryKey::QueryValue__
lea ecx, [esp + 0x18]
call fcn.00460fb0
push 0x49808c
lea ecx, [esp + 0x14]
push ecx
call fcn.00463572
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0x28
ret 8
Function at 0x4615c0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x24
cmp eax, 4
je 0x4615f3
cmp eax, 5
je 0x4615f3
push 0x3ec
push str.CRegistryKey::SetValue__
lea ecx, [esp + 8]
call fcn.00460fb0
push 0x49808c
lea eax, [esp + 4]
push eax
call fcn.00463572
mov ecx, dword [ecx]
push 4
lea edx, [esp + 0x30]
push edx
push eax
mov eax, dword [esp + 0x34]
push 0
push eax
call fcn.00460e80
push eax
call dword [section..rdata]
test eax, eax
je 0x461632
push eax
push str.CRegistryKey::SetValue__
lea ecx, [esp + 8]
call fcn.00460fb0
push 0x49808c
lea ecx, [esp + 4]
push ecx
call fcn.00463572
add esp, 0x24
ret 0xc

Function at 0x46eb2f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x5387e0
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x576ccc], 1
jge 0x53884f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x538825
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x538825
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x538802
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x53883b
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x538842
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x53894d
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movdqa xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movdqa xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movdqa xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x53891e
mov eax, dword [ebx + 8]
movdqu xmm0, xmmword [eax]
movdqa xmmword [ebp - 0x40], xmm0
movdqa xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movdqa xmmword [ebp - 0x20], xmm0
movdqa xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movdqa xmmword [ebp - 0x20], xmm0
movdqa xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movdqa xmmword [ebp - 0x40], xmm0
movdqa xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movdqa xmmword [ebp - 0x20], xmm0
movdqa xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x538913
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x538907
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x53890e
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x53894d
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x538948
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x538931
mov eax, dword [ebx + 8]
jmp 0x53894d
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x53893f
xor eax, eax
jmp 0x53894d
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x538872
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret