joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a100
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x718924]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x9c]
push 0x1b
push eax
call fcn.00463760
push 0x80
lea eax, [ebp - 0x84]
push 0
push eax
call fcn.004e30c0
add esp, 0x14
lea eax, [ebp - 0x9c]
cmp dword [ebp - 0x88], 8
cmovae eax, dword [ebp - 0x9c]
push eax
push 0x40
lea eax, [ebp - 0x84]
push eax
push 0x67495c
push str.InstallPerUser
push 0x679db4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, 0x67494c
lea eax, [ebp - 0x84]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x45a19b
test dx, dx
je 0x45a197
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x45a19b
add eax, 4
add ecx, 4
test dx, dx
jne 0x45a175
xor eax, eax
jmp 0x45a1a0
sbb eax, eax
or eax, 1
mov edx, dword [ebp - 0x88]
push ebx
xor ebx, ebx
test eax, eax
sete bl
cmp edx, 8
jb 0x45a1e4
mov ecx, dword [ebp - 0x9c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45a1da
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45a1f7
push edx
push ecx
call fcn.004cb4db
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.004cb998
mov esp, ebp
pop ebp
ret 4
call fcn.004e6589
int3

Function at 0x45a770
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x718924]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x9c]
push 0x1b
push eax
call fcn.00463760
push 0x80
lea eax, [ebp - 0x84]
push 0
push eax
call fcn.004e30c0
add esp, 0x14
lea eax, [ebp - 0x9c]
cmp dword [ebp - 0x88], 8
cmovae eax, dword [ebp - 0x9c]
push eax
push 0x40
lea eax, [ebp - 0x84]
push eax
push 0x67495c
push str.Inactive
push 0x679db4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, 0x67495c
lea eax, [ebp - 0x84]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x45a80b
test dx, dx
je 0x45a807
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x45a80b
add eax, 4
add ecx, 4
test dx, dx
jne 0x45a7e5
xor eax, eax
jmp 0x45a810
sbb eax, eax
or eax, 1
mov edx, dword [ebp - 0x88]
push ebx
xor ebx, ebx
test eax, eax
sete bl
cmp edx, 8
jb 0x45a854
mov ecx, dword [ebp - 0x9c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45a84a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45a867
push edx
push ecx
call fcn.004cb4db
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.004cb998
mov esp, ebp
pop ebp
ret 4
call fcn.004e6589
int3
Function at 0x45aa30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45aaa1
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x45aa6f
cmp eax, 2
jne 0x45aa8b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x45aa9b
test ecx, ecx
je 0x45aa96
test cl, 1
jne 0x45aa8b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x45aa9b
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x45ac60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x66a4a2
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x718924]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
push 0x208
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x21c], 1
call fcn.004e30c0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
je 0x45ad00
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45acf3
jmp 0x45ad4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x45ad5e
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004e30c0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x45ad5e
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45ad40
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0044e920
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cb998
mov esp, ebp
pop ebp
ret
Function at 0x45c510
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ecx]
cmp esi, 0x10
je 0x45c527
cmp esi, 0x20
jne 0x45c6fb
shr esi, 2
mov edx, 4
cmp esi, edx
mov dword [ebp - 0xc], esi
mov eax, esi
cmovb eax, edx
push edi
mov edi, dword [ebp + 8]
lea eax, [eax*4 + 0x1c]
mov dword [ebp - 8], eax
test edi, edi
je 0x45c6fa
mov dword [edi], 0x10
push ebx
mov dword [edi + 4], eax
xor ebx, ebx
add edi, 8
test esi, esi
je 0x45c592
lea edx, [ecx + 5]
movzx ecx, byte [edx - 1]
lea edx, [edx + 4]
movzx eax, byte [edx - 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 2]
shl ecx, 8
or ecx, eax
mov dword [edi + ebx*4], ecx
inc ebx
cmp ebx, esi
jl 0x45c565
mov eax, dword [ebp - 8]
mov ebx, dword [edi + ebx*4 - 4]
mov ecx, esi
cmp esi, eax
jge 0x45c67a
mov dword [ebp + 8], 0
mov dword [ebp - 4], edi
lea ebx, [ebx]
mov eax, ecx
cdq
idiv esi
test edx, edx
jne 0x45c610
mov eax, dword [ebp + 8]
cdq
idiv esi
mov dl, byte [eax + 0x674a40]
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx esi, byte [eax + str.cw]
movzx eax, dl
xor esi, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl esi, 8
movzx eax, byte [eax + str.cw]
xor esi, eax
movzx eax, bl
shl esi, 8
shr ebx, 0x18
movzx eax, byte [eax + str.cw]
xor esi, eax
movzx ebx, byte [ebx + str.cw]
shl esi, 8
xor ebx, esi
mov esi, dword [ebp - 0xc]
jmp 0x45c65d
cmp esi, 6
jbe 0x45c65d
cmp edx, 4
jne 0x45c65d
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + str.cw]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
xor edx, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl edx, 8
movzx eax, byte [eax + str.cw]
xor edx, eax
movzx eax, bl
shl edx, 8
movzx ebx, byte [eax + str.cw]
xor ebx, edx
mov eax, dword [ebp - 4]
inc dword [ebp + 8]
xor ebx, dword [eax]
add eax, 4
mov dword [edi + ecx*4], ebx
inc ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cmp ecx, eax
jl 0x45c5b0
xor esi, esi
sub ecx, 1
js 0x45c6f9
lea eax, [edi + eax*4]
mov dword [ebp + 8], eax
mov ebx, dword [edi + ecx*4]
cmp esi, 4
jl 0x45c6e9
cmp ecx, 4
jb 0x45c6e9
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + str.cw]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x676060]
movzx eax, byte [eax + str.cw]
xor edx, dword [eax*4 + 0x676460]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
xor edx, dword [eax*4 + 0x675c60]
movzx eax, bl
movzx eax, byte [eax + str.cw]
xor edx, dword [eax*4 + 0x676860]
mov eax, dword [ebp + 8]
jmp 0x45c6eb
mov edx, ebx
mov dword [eax], edx
inc esi
add eax, 4
sub ecx, 1
mov dword [ebp + 8], eax
jns 0x45c687
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x45da00
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 8
push ebx
push esi
push edi
test ecx, ecx
je 0x45dbd8
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x45dbd8
test bl, 3
jne 0x45dbd8
lea eax, [ebx - 1]
xor edx, edx
add eax, ecx
mov dword [ebp - 8], edx
cmp byte [eax], 0x3d
jne 0x45da4a
inc edx
dec eax
mov dword [ebp - 8], edx
cmp edx, 2
ja 0x45dbd8
cmp byte [eax], 0x3d
je 0x45da37
shr ebx, 2
xor edi, edi
mov dword [ebp + 8], edi
mov dword [ebp + 0x10], ebx
test ebx, ebx
je 0x45dbcd
lea esi, [ecx + 2]
mov dword [ebp - 4], esi
mov al, byte [esi - 2]
lea ecx, [eax - 0x41]
cmp cl, 0x19
ja 0x45da72
sub al, 0x41
jmp 0x45daa1
lea ecx, [eax - 0x61]
cmp cl, 0x19
ja 0x45da7e
sub al, 0x47
jmp 0x45daa1
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x45da8a
add al, 4
jmp 0x45daa1
cmp al, 0x2b
jne 0x45da92
mov al, 0x3e
jmp 0x45daa1
cmp al, 0x2f
jne 0x45da9a
mov al, 0x3f
jmp 0x45daa1
cmp al, 0x3d
sete al
sub al, 1
mov dl, byte [esi - 1]
lea ecx, [edx - 0x41]
cmp cl, 0x19
ja 0x45dab1
sub dl, 0x41
jmp 0x45dae5
lea ecx, [edx - 0x61]
cmp cl, 0x19
ja 0x45dabe
sub dl, 0x47
jmp 0x45dae5
lea ecx, [edx - 0x30]
cmp cl, 9
ja 0x45dacb
add dl, 4
jmp 0x45dae5
cmp dl, 0x2b
jne 0x45dad4
mov dl, 0x3e
jmp 0x45dae5
cmp dl, 0x2f
jne 0x45dadd
mov dl, 0x3f
jmp 0x45dae5
cmp dl, 0x3d
sete dl
dec dl
mov bl, byte [esi]
lea ecx, [ebx - 0x41]
cmp cl, 0x19
ja 0x45daf4
sub bl, 0x41
jmp 0x45db28
lea ecx, [ebx - 0x61]
cmp cl, 0x19
ja 0x45db01
sub bl, 0x47
jmp 0x45db28
lea ecx, [ebx - 0x30]
cmp cl, 9
ja 0x45db0e
add bl, 4
jmp 0x45db28
cmp bl, 0x2b
jne 0x45db17
mov bl, 0x3e
jmp 0x45db28
cmp bl, 0x2f
jne 0x45db20
mov bl, 0x3f
jmp 0x45db28
cmp bl, 0x3d
sete bl
dec bl
mov ah, byte [esi + 1]
mov cl, ah
sub cl, 0x41
cmp cl, 0x19
ja 0x45db3a
sub ah, 0x41
jmp 0x45db72
mov cl, ah
sub cl, 0x61
cmp cl, 0x19
ja 0x45db49
sub ah, 0x47
jmp 0x45db72
mov cl, ah
sub cl, 0x30
cmp cl, 9
ja 0x45db58
add ah, 4
jmp 0x45db72
cmp ah, 0x2b
jne 0x45db61
mov ah, 0x3e
jmp 0x45db72
cmp ah, 0x2f
jne 0x45db6a
mov ah, 0x3f
jmp 0x45db72
cmp ah, 0x3d
sete ah
dec ah
cmp al, 0xff
je 0x45dbd8
cmp dl, 0xff
je 0x45dbd8
cmp bl, 0xff
je 0x45dbd8
cmp ah, 0xff
je 0x45dbd8
mov esi, dword [ebp + 0xc]
mov cl, dl
shl al, 2
shr cl, 4
or cl, al
shl dl, 4
mov byte [edi + esi], cl
mov al, bl
mov ecx, esi
shr al, 2
mov esi, dword [ebp - 4]
or al, dl
shl bl, 6
add esi, 4
or bl, ah
mov dword [ebp - 4], esi
mov byte [edi + ecx + 1], al
mov eax, dword [ebp + 8]
inc eax
mov byte [edi + ecx + 2], bl
add edi, 3
mov dword [ebp + 8], eax
cmp eax, dword [ebp + 0x10]
jb 0x45da63
mov edx, dword [ebp - 8]
sub edi, edx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45e120
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
push edi
je 0x45e293
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x45e293
mov eax, 0xaaaaaaab
mov ecx, edi
mul edi
push ebx
mov ebx, edx
shr ebx, 1
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebx + ebx*2]
sub ecx, eax
mov eax, 0
mov dword [ebp - 4], ecx
setne al
add eax, ebx
shl eax, 2
mov dword [ebp - 8], eax
test esi, esi
je 0x45e28c
xor eax, eax
test ebx, ebx
je 0x45e1f0
mov edi, dword [ebp + 8]
add edi, 2
lea ebx, [ebx]
movzx ecx, byte [edi - 2]
lea edi, [edi + 3]
shr ecx, 2
movzx ecx, byte [ecx + 0x676c60]
mov byte [eax + esi], cl
movzx edx, byte [edi - 5]
movzx ecx, byte [edi - 4]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + 0x676c60]
mov byte [eax + esi + 1], cl
movzx edx, byte [edi - 4]
movzx ecx, byte [edi - 3]
and edx, 0xf
shr ecx, 6
shl edx, 2
or edx, ecx
movzx ecx, byte [edx + 0x676c60]
mov byte [eax + esi + 2], cl
movzx ecx, byte [edi - 3]
and ecx, 0x3f
movzx ecx, byte [ecx + 0x676c60]
mov byte [eax + esi + 3], cl
add eax, 4
sub ebx, 1
jne 0x45e180
mov ecx, dword [ebp - 4]
mov edi, dword [ebp + 0x10]
sub ecx, 1
je 0x45e257
sub ecx, 1
jne 0x45e289
mov ebx, dword [ebp + 8]
movzx ecx, byte [ebx + edi - 2]
shr ecx, 2
movzx ecx, byte [ecx + 0x676c60]
mov byte [eax + esi], cl
movzx edx, byte [ebx + edi - 2]
movzx ecx, byte [ebx + edi - 1]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + 0x676c60]
mov byte [eax + esi + 1], cl
lea ecx, [eax + 2]
movzx eax, byte [ebx + edi - 1]
and eax, 0xf
mov al, byte [eax*4 + 0x676c60]
mov byte [ecx + esi], al
mov eax, dword [ebp - 8]
mov byte [ecx + esi + 1], 0x3d
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
movzx ecx, byte [edx + edi - 1]
shr ecx, 2
movzx ecx, byte [ecx + 0x676c60]
mov byte [eax + esi], cl
movzx ecx, byte [edx + edi - 1]
and ecx, 3
shl ecx, 4
movzx ecx, byte [ecx + 0x676c60]
mov byte [eax + esi + 1], cl
mov word [eax + esi + 2], 0x3d3d
mov eax, dword [ebp - 8]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x45e670
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x66a7dc
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x718924]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x72249c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x720954]
cmp eax, dword [ecx + 4]
jg 0x45e6e3
jmp 0x45e6c4
mov al, byte [ecx]
inc ecx
test al, al
je 0x45e7e8
jmp 0x45e6b7
mov eax, 0x72093c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cb998
mov esp, ebp
pop ebp
ret
push 0x720954
call fcn.004cb872
add esp, 4
cmp dword [0x720954], 0xffffffff
jne 0x45e6c4
mov byte [ebp - 0x34], 0x69
mov byte [ebp - 0x33], 0x6f
mov byte [ebp - 0x32], 0x4e
mov byte [ebp - 0x31], 0x69
mov byte [ebp - 0x30], 0x2c
mov byte [ebp - 0x2f], 0x11
mov byte [ebp - 0x2e], 0x25
mov byte [ebp - 0x2d], 0x4e
mov byte [ebp - 0x2c], 0x7d
mov byte [ebp - 0x2b], 0x2c
mov byte [ebp - 0x2a], 0x11
mov byte [ebp - 0x29], 0x2c
mov byte [ebp - 0x28], 0x54
mov byte [ebp - 0x27], 0x26
mov byte [ebp - 0x26], 0x18
mov byte [ebp - 0x25], 0x68
mov byte [ebp - 0x24], 0x3a
mov byte [ebp - 0x23], 0x18
mov byte [ebp - 0x22], 4
mov byte [ebp - 0x21], 0x3a
mov byte [ebp - 0x20], 0x25
mov byte [ebp - 0x1f], 0x4e
mov byte [ebp - 0x1e], 0x6f
mov byte [ebp - 0x1d], 0x6f
mov byte [ebp - 0x1c], 0x12
mov byte [ebp - 0x1b], 4
mov byte [ebp - 0x1a], 0x3a
mov byte [ebp - 0x19], 0x18
mov byte [ebp - 0x18], 0x7c
mov byte [ebp - 0x17], 4
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x15], 0x25
mov byte [ebp - 0x14], 0
mov al, byte [ebp - 0x34]
mov byte [ebp - 0x13], 0
cmp byte [ebp - 0x13], 0
mov dword [ebp - 4], 0
jne 0x45e7c2
xor ecx, ecx
mov byte [ebp - 0x13], 1
lea esi, [ecx + 0x7f]
jmp 0x45e7a0
mov al, byte [ebp + ecx - 0x34]
movsx eax, al
sub eax, 0x6c
imul eax, eax, 0x13
cdq
idiv esi
lea eax, [edx + 0x7f]
cdq
idiv esi
mov byte [ebp + ecx - 0x34], dl
inc ecx
cmp ecx, 0x20
jb 0x45e7a0
jmp 0x45e7c2
lea ecx, [ebp - 0x34]
mov dword [0x72094c], 0
mov dword [0x720950], 0xf
lea edx, [ecx + 1]
mov byte [0x72093c], 0
jmp 0x45e6b7
sub ecx, edx
lea eax, [ebp - 0x34]
push ecx
push eax
mov ecx, 0x72093c
call fcn.0045d850
push 0x6729f0
call fcn.004cb72a
push 0x720954
call fcn.004cb828
add esp, 8
jmp 0x45e6c4
Function at 0x460c90
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x66a9c8
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x718924]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x14], 0
je 0x460e5a
push 0x11
xor eax, eax
mov dword [ebp - 0x18], 0
push 0x676d00
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
call fcn.0044e920
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.0045ae70
push eax
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 1
push eax
call fcn.0045e2a0
push eax
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 2
push eax
call fcn.0045ab70
mov edx, dword [ebp - 0x34]
add esp, 0x18
cmp edx, 0x10
jb 0x460d5e
mov ecx, dword [ebp - 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x460d54
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x460e75
push edx
push ecx
call fcn.004cb4db
add esp, 8
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], 0
cmp edx, 0x10
jb 0x460da4
mov ecx, dword [ebp - 0x60]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x460d9a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x460e75
push edx
push ecx
call fcn.004cb4db
add esp, 8
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0xf
mov byte [ebp - 0x60], 0
cmp edx, 8
jb 0x460df0
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x460de6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x460e75
push edx
push ecx
call fcn.004cb4db
add esp, 8
cmp dword [edi + 0x18], 8
lea esi, [edi + 4]
mov ecx, esi
jb 0x460dfd
mov ecx, dword [esi]
cmp dword [ebp - 0x64], 8
lea eax, [ebp - 0x78]
push ecx
cmovae eax, dword [ebp - 0x78]
lea ecx, [ebp - 0x18]
push 4
push ecx
push 0
push eax
push str.Support
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x460e29
mov word [edi + 0x3c], 0x101
jmp 0x460e52
cmp dword [esi + 0x14], 8
jb 0x460e31
mov esi, dword [esi]
push esi
push 4
lea eax, [ebp - 0x18]
push eax
push 0
push 0x676d00
push str.Support
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x460e52
mov byte [edi + 0x3d], 1
lea ecx, [ebp - 0x78]
call fcn.00448fb0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cb998
mov esp, ebp
pop ebp
ret
call fcn.004e6589
int3
Function at 0x463740
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x463759
test al, 0x10
jne 0x463759
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret
Function at 0x467a40
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x66b280
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x718924]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 8]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x467a86
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0044e920
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call fcn.00468a60
mov esi, eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00468e20
add esp, 0xc
xor edi, edi
mov byte [ebp - 4], 1
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x44]
push eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
or eax, 0x20006
push eax
push edi
push ecx
push esi
mov dword [ebp - 0x44], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x467b10
jg 0x467af5
mov edi, eax
jmp 0x467afe
movzx edi, ax
or edi, 0x80070000
push edi
push str.Failed_RegCreateKeyExW:_0x_08x.
push str.kupdate::KRegistry::DeleteValue
push 0x131
jmp 0x467b53
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x44]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x467b62
jg 0x467b3a
mov edi, esi
jmp 0x467b43
movzx edi, si
or edi, 0x80070000
push edi
push str.Failed_RegDeleteValue:_0x_08x.
push str.kupdate::KRegistry::DeleteValue
push 0x138
push str.D:publish_283488_rc_2404Coding_supportwpsupdateUpdateClient_srcutilKRegistry.cpp
push 0
call fcn.0048ffd0
add esp, 0x18
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x467b98
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x467b8e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x467bff
push edx
push ecx
call fcn.004cb4db
add esp, 8
mov edx, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
cmp edx, 8
jb 0x467be2
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x467bd8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x467bff
push edx
push ecx
call fcn.004cb4db
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cb998
mov esp, ebp
pop ebp
ret
call fcn.004e6589
int3
Function at 0x467c10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x66b2b8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x718924]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 8]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x467c56
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0044e920
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call fcn.00468a60
mov esi, eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00468e20
add esp, 0xc
mov dword [ebp - 0x44], 0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push eax
mov eax, dword [ebp + 0xc]
or eax, 0x20019
push eax
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x467cc2
xor bl, bl
jmp 0x467ce4
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push 0
cmovae eax, dword [ebp - 0x40]
push 0
push 0
push 0
push eax
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete bl
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x467d1a
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x467d10
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x467d81
push edx
push ecx
call fcn.004cb4db
add esp, 8
mov edx, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
cmp edx, 8
jb 0x467d64
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x467d5a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x467d81
push edx
push ecx
call fcn.004cb4db
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cb998
mov esp, ebp
pop ebp
ret
call fcn.004e6589
int3