joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466100
Capabilities:
Check if file exists
Copy file
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0042cec0
mov eax, dword [0x4be5b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1008], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
test eax, eax
je 0x466295
test esi, esi
je 0x466295
push 0x800
lea eax, [ebp - 0x1004]
push 0
push eax
call fcn.00432c40
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.00432c40
push 0x400
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.0046efe4
add esp, 0x24
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x1004]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x466267
push esi
push str.Dest_File_Exist:__s
call fcn.0044e890
push esi
call fcn.00454b60
add esp, 0xc
test eax, eax
jne 0x466267
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Delete_File__s_Failed__error___d
call fcn.0044e890
add esp, 0xc
lea eax, [ebp - 0x804]
push eax
push 0
push 0x4ac4e0
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x804]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x4662aa
lea eax, [ebp - 0x804]
push eax
push esi
push str.Rename_File__s_to__s_success
call fcn.0044e890
add esp, 0xc
lea eax, [ebp - 0x804]
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test ebx, ebx
je 0x466240
mov dword [ebx], 4
cmp dword [edi + 0x7c], 0
jne 0x466267
push esi
mov ecx, edi
call fcn.00464a60
test eax, eax
je 0x466267
push esi
push str.check_file__s___need_reboot_now
call fcn.0044e890
add esp, 8
mov dword [edi + 0x7c], 1
mov ebx, dword [ebp - 0x1008]
push 0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x46630e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push ebx
push str.Copy_From__s_to__s_Failed_Error_Code___d
call fcn.0044e890
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042c75e
mov esp, ebp
pop ebp
ret 0xc
push esi
push str.Rename_File__s_failed__replace_until_reboot
call fcn.0044e890
add esp, 8
lea eax, [ebp - 0x804]
push 0
push eax
push dword [ebp - 0x1008]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 5
push esi
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test ebx, ebx
je 0x4662e7
mov dword [ebx], 5
cmp dword [edi + 0x7c], 0
jne 0x46630e
push esi
mov ecx, edi
call fcn.00464a60
test eax, eax
je 0x46630e
push esi
push str.check_file__s___need_reboot_now
call fcn.0044e890
add esp, 8
mov dword [edi + 0x7c], 1
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042c75e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4675d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47ba10
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4be5b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x4c]
mov dword [ebp - 4], 0
mov dword [esi], vtable.CFileManager.0
mov dword [esi + 4], vtable.CFileManager.1.0
mov dword [esi + 0x64], 1
test eax, eax
je 0x467631
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x4c], 0
push dword [esi + 0x3c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x467649
push dword [esi + 0x3c]
call fcn.00454870
add esp, 4
lea ecx, [esi + 0x40]
call fcn.00459490
mov edx, dword [esi + 0x3c]
or edi, 0xffffffff
sub edx, 0x10
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x46766e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov edx, dword [esi + 0x20]
sub edx, 0x10
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x467690
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test byte [ebp + 8], 1
je 0x4676a1
push 0x68
push esi
call fcn.0042c4b6
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x467940
Capabilities:
Check if file exists
Get system information on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4b94a0
push 0x431fe0
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x4be5b4]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x48], ecx
mov edi, 0xffffd8f0
mov dword [ebp - 0x34], edi
or ebx, 0xffffffff
mov dword [ebp - 0x44], ebx
xor esi, esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 4], esi
mov eax, dword [eax + 0x20]
cmp dword [eax - 0xc], esi
jne 0x4679b3
mov edi, 0xffffd8ee
mov dword [ebp - 0x34], edi
jmp 0x467ab5
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4679a6
push 0
push 1
push 3
push 0
push 7
push SysReAllocString
mov eax, dword [ebp - 0x30]
push dword [eax + 0x20]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x44], ebx
cmp ebx, 0xffffffff
je 0x467ab5
push 0
push 0
push 0
push 2
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x38], eax
test eax, eax
je 0x467ab2
mov eax, dword [ebp - 0x30]
mov esi, dword [eax + 8]
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, esi
xor edx, edx
div dword [ebp - 0x58]
sub esi, edx
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
sub eax, esi
mov dword [ebp - 0x3c], eax
push 0
push esi
push 0
push 4
mov esi, dword [ebp - 0x38]
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x40], eax
test eax, eax
je 0x467ab5
mov ecx, dword [ebp - 0x3c]
add ecx, eax
mov dword [ebp - 0x50], ecx
je 0x467ab5
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x30]
push dword [eax + 0xc]
push ecx
call fcn.0045bad0
add esp, 0xc
mov edx, dword [ebp - 0x30]
add edx, 0x10
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x3c], 0xc
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4679a6
add ecx, 4
add edx, 4
sub dword [ebp - 0x3c], 4
jae 0x467a70
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx + 0xc]
cdq
push edx
push eax
push dword [ebp - 0x50]
push dword [ecx + 0x20]
call fcn.00470800
add esp, 0x18
mov ecx, 1
test eax, eax
cmovns edi, ecx
mov dword [ebp - 0x34], edi
jmp 0x467ab5
mov esi, dword [ebp - 0x38]
mov dword [ebp - 4], 0xfffffffe
call fcn.00467aea
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0042c75e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x467bb0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1318
call fcn.0042cec0
mov eax, dword [0x4be5b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [eax]
mov dword [ebp - 0x1318], ecx
cmp dword [edi - 0xc], 0x104
jg 0x467d78
push 0x800
lea eax, [ebp - 0x1304]
push 0
push eax
call fcn.00432c40
push 0x800
lea eax, [ebp - 0xb04]
push 0
push eax
call fcn.00432c40
push edi
lea eax, [ebp - 0x1304]
push 0x400
push eax
call fcn.0044310e
add esp, 0x24
test esi, esi
je 0x467c3b
cmp word [esi], 0
je 0x467c3b
push esi
lea eax, [ebp - 0x1304]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0xfe
lea eax, [ebp - 0x102]
push 0
push eax
call fcn.00432c40
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor esi, esi
nop
xor eax, eax
xorps xmm0, xmm0
mov word [ebp - 0x104], ax
lea eax, [ebp - 0x1314]
push eax
movups xmmword [ebp - 0x1314], xmm0
call dword [sym.imp.ole32.dll_CoCreateGuid]
push 0x200
lea eax, [ebp - 0x304]
push 0
push eax
call fcn.00432c40
movzx eax, byte [ebp - 0x1305]
push eax
movzx eax, byte [ebp - 0x1306]
push eax
movzx eax, byte [ebp - 0x1307]
push eax
movzx eax, byte [ebp - 0x1308]
push eax
movzx eax, byte [ebp - 0x1309]
push eax
movzx eax, byte [ebp - 0x130a]
push eax
movzx eax, byte [ebp - 0x130b]
push eax
movzx eax, byte [ebp - 0x130c]
push eax
movzx eax, word [ebp - 0x130e]
push eax
movzx eax, word [ebp - 0x1310]
push eax
push dword [ebp - 0x1314]
lea eax, [ebp - 0x304]
push str._08X__04X__04x__02X_02X__02X_02X_02X_02X_02X_02X
push eax
call fcn.00452580
lea eax, [ebp - 0x304]
add esp, 0x40
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x467d06
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x104]
push 0x80
push eax
call fcn.00440308
add esp, 0x10
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x1304]
push eax
lea eax, [ebp - 0xb04]
push eax
call edi
push 0x4ac088
lea eax, [ebp - 0xb04]
push 0x400
push eax
call fcn.0044726c
add esp, 0xc
lea eax, [ebp - 0xb04]
push eax
call ebx
test eax, eax
je 0x467d8b
inc esi
cmp esi, 0xa
jl 0x467c60
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042c75e
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0xb04]
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x467d94
mov ecx, dword [ebp - 0x1318]
lea eax, [ebp - 0xb04]
sub edx, esi
sar edx, 1
push edx
push eax
call fcn.00416a50
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042c75e
mov esp, ebp
pop ebp
ret
Function at 0x4688c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1858
call fcn.0042cec0
mov eax, dword [0x4be5b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x804]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
push 0x800
push 0
push eax
call fcn.00432c40
add esp, 0xc
cmp dword [ebp + 0x24], 0
je 0x46892a
push 0x400
lea eax, [ebp - 0x804]
push eax
push esi
push ebx
call fcn.00468740
add esp, 0x10
test eax, eax
jne 0x468942
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042c75e
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x804]
sub ecx, esi
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x468932
xorps xmm0, xmm0
mov dword [ebp - 0x1858], 0x44
lea eax, [ebp - 0x1858]
movlpd qword [ebp - 0x1854], xmm0
push eax
movlpd qword [ebp - 0x184c], xmm0
movlpd qword [ebp - 0x1844], xmm0
movlpd qword [ebp - 0x183c], xmm0
movlpd qword [ebp - 0x1834], xmm0
movlpd qword [ebp - 0x182c], xmm0
movlpd qword [ebp - 0x1824], xmm0
movlpd qword [ebp - 0x181c], xmm0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov ax, word [ebp + 0x14]
xorps xmm0, xmm0
push 0x1000
mov word [ebp - 0x1828], ax
lea eax, [ebp - 0x1804]
push 0
push eax
mov dword [ebp - 0x182c], 1
movups xmmword [ebp - 0x1814], xmm0
call fcn.00432c40
add esp, 0xc
lea eax, [ebp - 0x804]
test edi, edi
je 0x4689f3
push edi
push eax
lea eax, [ebp - 0x1804]
push str.__s___s
push eax
call fcn.00403ab0
add esp, 0x10
jmp 0x468a08
push eax
lea eax, [ebp - 0x1804]
push str.__s_
push eax
call fcn.00403ab0
add esp, 0xc
lea eax, [ebp - 0x1814]
push eax
lea eax, [ebp - 0x1858]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1804]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test edi, edi
je 0x468a76
cmp dword [ebp + 0x18], 0
je 0x468a4c
push dword [ebp + 0x1c]
push dword [ebp - 0x1814]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov eax, dword [ebp + 0x28]
test eax, eax
je 0x468a60
push eax
push dword [ebp - 0x1814]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x1810]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1814]
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042c75e
mov esp, ebp
pop ebp
ret
Function at 0x468ae0
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4be5b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x214], 0x104
test edi, edi
je 0x468ba4
lea eax, [ebp - 0x218]
mov dword [ebp - 0x210], 0
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push edi
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x468ba4
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x468ba4
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x468ba4
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push edi
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x468b9d
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042c75e
mov esp, ebp
pop ebp
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0042c75e
mov esp, ebp
pop ebp
ret 4
Function at 0x468d00
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
mov eax, dword [0x4be5b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x438], eax
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x428], edi
test eax, eax
jne 0x468d3b
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042c75e
mov esp, ebp
pop ebp
ret 0x14
push ebx
xor ebx, ebx
lea ecx, [ebp - 0x42c]
push ecx
push ebx
lea ecx, [ebp - 0x418]
mov dword [ebp - 0x42c], ebx
push ecx
push ebx
push ebx
push 4
push dword [ebp + 0xc]
mov dword [ebp - 0x418], ebx
push eax
call dword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
test eax, eax
jne 0x468f12
push esi
mov esi, dword [ebp + 0x10]
cmp esi, 2
je 0x468d81
cmp esi, 1
jne 0x468e20
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x468e20
lea ecx, [ebp - 0x430]
mov dword [ebp - 0x424], ebx
push ecx
lea ecx, [ebp - 0x424]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_GetExplicitEntriesFromAclW]
test eax, eax
jne 0x468e20
mov esi, dword [ebp - 0x424]
sub esi, 1
js 0x468e1d
mov ebx, dword [ebp - 0x428]
mov edi, esi
shl edi, 5
nop word [eax + eax]
mov eax, dword [ebp - 0x430]
cmp dword [edi + eax + 4], 3
jne 0x468e0d
test ebx, ebx
je 0x468e00
cmp dword [edi + eax + 0x14], 0
jne 0x468e0d
add eax, 0xc
push ebx
add eax, edi
push eax
call dword [sym.imp.ADVAPI32.dll_GetTrusteeNameW]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x468e0d
push esi
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_DeleteAce]
sub edi, 0x20
sub esi, 1
jns 0x468dd0
mov edi, dword [ebp - 0x428]
xor ebx, ebx
mov esi, dword [ebp + 0x10]
push 0x208
xorps xmm0, xmm0
mov dword [ebp - 0x41c], 0
lea eax, [ebp - 0x20c]
push 0
push eax
movups xmmword [ebp - 0x458], xmm0
movups xmmword [ebp - 0x448], xmm0
call fcn.00432c40
add esp, 0xc
mov dword [ebp - 0x434], 0x104
test edi, edi
je 0x468e95
lea eax, [ebp - 0x430]
mov dword [ebp - 0x420], 0x104
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
push 3
push esi
push dword [ebp + 0x18]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.ADVAPI32.dll_BuildExplicitAccessWithNameW]
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x418]
lea eax, [ebp - 0x458]
push eax
push 1
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
test eax, eax
jne 0x468f04
push 0
push dword [ebp - 0x41c]
push 0
push 0
push 4
push dword [ebp + 0xc]
push dword [ebp - 0x438]
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
neg eax
sbb ebx, ebx
mov eax, dword [ebp - 0x41c]
inc ebx
test eax, eax
je 0x468f04
push eax
call esi
mov eax, dword [ebp - 0x42c]
test eax, eax
je 0x468f11
push eax
call esi
pop esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop ebx
xor ecx, ebp
pop edi
call fcn.0042c75e
mov esp, ebp
pop ebp
ret 0x14
Function at 0x46a990
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
xor al, al
push edi
xor edi, edi
test esi, esi
je 0x46aa57
push ebx
mov ecx, dword [ebp + 8]
mov dl, byte [edi + ecx]
xor dl, al
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
movzx ecx, cl
xor al, 0x8c
and bl, 1
movzx eax, al
cmove eax, ecx
inc edi
cmp edi, esi
jb 0x46a9a5
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x46c150
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x480493
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x4be5b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x8c], 0
mov dword [ebx], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
push 0x201
push dword [0x4c0320]
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 0
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0046c0a0
mov edi, dword [ebp - 0x8c]
test eax, eax
jne 0x46c331
push 0x64
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.00432c40
add esp, 0xc
mov dword [ebp - 0x78], 0x64
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push 0x4af44c
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x46c331
mov eax, dword [ebp - 0x7c]
cmp eax, 1
je 0x46c225
cmp eax, 2
jne 0x46c331
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x46c246
test cl, 1
jne 0x46c331
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x76], 0
je 0x46c24c
jmp 0x46c331
xor eax, eax
mov word [ebp - 0x74], ax
shr ecx, 1
cmp ecx, 0x2d
jne 0x46c331
call fcn.0040b4c0
mov ecx, eax
test ecx, ecx
je 0x46c35c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x78]
call fcn.0046a600
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0
push eax
lea eax, [ebp - 0x20]
push 0x4af454
push eax
call fcn.0045bb50
mov esi, dword [ebp - 0x78]
push 0x2a
push esi
call fcn.0046a990
movzx eax, al
add esp, 0x14
cmp dword [ebp - 0x7c], eax
jne 0x46c315
lea edx, [ebp - 0x74]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x46c2b6
sub edx, ecx
lea eax, [ebp - 0x74]
mov ecx, dword [ebp - 0x80]
sar edx, 1
push edx
push eax
call fcn.00416a50
push dword [0x4c0328]
lea eax, [ebp - 0x74]
push dword [0x4c0324]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x46c2f2
mov dword [ebx], 1
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x46c30e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 1
jmp 0x46c333
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x46c331
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor esi, esi
test edi, edi
je 0x46c33e
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042c75e
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004068b0
int3
Function at 0x46c370
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4804c8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4be5b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x202
push dword [0x4c0320]
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0046c0a0
test eax, eax
je 0x46c498
mov esi, dword [ebp - 0x18]
mov edi, dword [0x4c0320]
mov dword [ebp - 0x10], 0
test esi, esi
je 0x46c443
cmp dword [esi], 0
je 0x46c436
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x46c403
mov eax, 1
jmp 0x46c464
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x46c43c
push 0
push dword [esi]
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0x20206
push 0
push 0
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call eax
jmp 0x46c464
cmp dword [esi + 4], 0
jne 0x46c443
mov eax, 1
jmp 0x46c464
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x20206
push 0
push 0
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x46c48e
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x46c476
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0x200
test eax, eax
je 0x46c49b
xor ebx, ebx
jmp 0x46c53f
mov esi, dword [ebp - 0x20]
xor ebx, ebx
jmp 0x46c53f
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x46c4f8
mov ecx, dword [ebx]
test ecx, ecx
je 0x46c55e
push ecx
push eax
call fcn.004405f1
add esp, 8
test eax, eax
je 0x46c4f8
mov edx, dword [edi]
test edx, edx
je 0x46c4f8
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46c4d0
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.m2_old
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebx]
test edx, edx
jne 0x46c503
lea eax, [edx + 0xd]
jmp 0x46c538
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46c510
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0x4af44c
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
test esi, esi
je 0x46c54a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004068b0
int3