joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ec4
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401ed6
mov eax, dword [0x66509f]
shl eax, 2
mov dword [0x6650a3], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleW
mov edx, eax
call fcn.00653d0c
pop edx
call fcn.00653c34
call fcn.00653e64
push 0
call fcn.00655a84
pop ecx
push 0x665048
push 0
call sub.KERNEL32.DLL_GetModuleHandleW
mov dword [0x6650a7], eax
push 0
jmp fcn.0065f038

Function at 0x40211c
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
push 0x745078
push 1
push 0
push 0x745088
call sub.OLE32.DLL_CoCreateInstance
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x402217
push dword [ebp - 8]
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x50]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x40220e
push dword [ebp + 0x18]
mov eax, dword [ebp - 0x10]
push eax
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x40220e
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x24]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x40220e
push dword [ebp + 8]
push dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x44]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x40220e
mov ax, word [ebp + 0x14]
push eax
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x34]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x40220e
push dword [ebp + 0x10]
mov eax, dword [ebp - 0x10]
push eax
mov edx, dword [eax]
call dword [edx + 0x3c]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x40220e
lea ecx, [ebp - 0x14]
push ecx
push 0x745098
mov eax, dword [ebp - 0x10]
push eax
mov edx, dword [eax]
call dword [edx]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x40220e
push 1
push dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [edx]
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
push eax
mov edx, dword [eax]
call dword [edx + 8]
cmp dword [ebp - 0x18], 0
setge al
and eax, 1
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4024c4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
mov eax, 0x6871f0
call fcn.00654e18
lea edx, [ebp - 0x34]
push edx
call sub.SHELL32.DLL_SHGetMalloc
test eax, eax
jl 0x402573
lea ecx, [ebp - 0x30]
push ecx
push dword [ebp + 0xc]
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
test eax, eax
jl 0x40256a
lea eax, [ebp - 0x138]
push eax
push dword [ebp - 0x30]
call sub.SHELL32.DLL_SHGetPathFromIDListA
test eax, eax
jne 0x40255e
mov word [ebp - 0x1c], 0xc
mov edx, 0x68412f
lea eax, [ebp - 4]
call fcn.006628f0
inc dword [ebp - 0x10]
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.00662aa8
mov eax, dword [ebp + 8]
mov word [ebp - 0x1c], 0x18
push eax
dec dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00662a80
pop eax
mov word [ebp - 0x1c], 0xc
inc dword [ebp - 0x10]
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
jmp 0x4025c3
push dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x14]
mov edx, dword [ebp - 0x34]
push edx
mov ecx, dword [edx]
call dword [ecx + 8]
mov word [ebp - 0x1c], 0x24
lea edx, [ebp - 0x138]
lea eax, [ebp - 8]
call fcn.006628f0
inc dword [ebp - 0x10]
lea edx, [ebp - 8]
mov eax, dword [ebp + 8]
call fcn.00662aa8
mov eax, dword [ebp + 8]
mov word [ebp - 0x1c], 0x30
push eax
dec dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00662a80
pop eax
mov word [ebp - 0x1c], 0x24
inc dword [ebp - 0x10]
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret

Function at 0x402698
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push 0x3c
push 0
lea eax, [ebp - 0x3c]
push eax
call fcn.006548f7
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
mov edx, dword [ebp + 8]
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], 0x500
mov dword [ebp - 0x30], str.runas
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 1
lea edx, [ebp - 0x3c]
push edx
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
jne 0x4026ed
xor eax, eax
jmp 0x4026f2
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40300c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
mov eax, 0x6874bc
call fcn.00654e18
lea edx, [ebp - 0x130]
push edx
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
mov word [ebp - 0x1c], 0x18
lea edx, [ebp - 0x130]
lea eax, [ebp - 4]
mov ecx, 0xfde9
call fcn.00661cfc
inc dword [ebp - 0x10]
inc dword [ebp - 0x10]
mov word [ebp - 0x1c], 0xc
mov word [ebp - 0x1c], 0x24
lea eax, [ebp - 8]
call fcn.00402d54
inc dword [ebp - 0x10]
lea ecx, [ebp - 8]
inc dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
add edx, 0x34
lea eax, [ebp - 4]
call fcn.00402d84
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.00661e84
sub dword [ebp - 0x10], 2
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040240c
mov word [ebp - 0x1c], 0x30
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.00661e84
mov eax, dword [ebp + 8]
mov word [ebp - 0x1c], 0x3c
push eax
sub dword [ebp - 0x10], 2
lea eax, [ebp - 4]
mov edx, 2
call fcn.0040240c
pop eax
mov word [ebp - 0x1c], 0x30
add dword [ebp - 0x10], 2
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret

Function at 0x403db4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 8]
push 0x402340
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
pop ebp
ret
Function at 0x42283c
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd88
mov eax, 0x6ad8cc
call fcn.00654e18
mov dword [ebp - 0x28], 1
lea edx, [ebp + 8]
lea eax, [ebp + 8]
call fcn.00662930
inc dword [ebp - 0x28]
mov word [ebp - 0x34], 0xc
mov byte [ebp - 0x49], 0
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x278], 0x22c
lea edx, [ebp - 0x278]
push edx
push dword [ebp - 0x48]
call sub.KERNEL32.DLL_Process32FirstW
test eax, eax
jne 0x4229f0
mov word [ebp - 0x34], 0x18
lea edx, [ebp - 0x254]
lea eax, [ebp - 4]
call fcn.00662a1c
inc dword [ebp - 0x28]
mov eax, dword [eax]
xor edx, edx
mov dword [ebp - 8], edx
lea edx, [ebp - 8]
inc dword [ebp - 0x28]
call fcn.0048b284
lea eax, [ebp - 8]
xor ecx, ecx
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 0xc]
inc dword [ebp - 0x28]
call fcn.00662c4c
lea eax, [ebp - 0xc]
push eax
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea edx, [ebp - 0x10]
inc dword [ebp - 0x28]
lea eax, [ebp + 8]
call fcn.00662c4c
lea edx, [ebp - 0x10]
pop eax
call fcn.00662b54
push eax
dec dword [ebp - 0x28]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00662a80
dec dword [ebp - 0x28]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00662a80
dec dword [ebp - 0x28]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00662a80
dec dword [ebp - 0x28]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00662a80
pop ecx
test cl, cl
je 0x4229f0
mov byte [ebp - 0x49], 1
jmp 0x4229f0
mov word [ebp - 0x34], 0x24
lea edx, [ebp - 0x254]
lea eax, [ebp - 0x14]
call fcn.00662a1c
inc dword [ebp - 0x28]
mov eax, dword [eax]
xor edx, edx
mov dword [ebp - 0x18], edx
lea edx, [ebp - 0x18]
inc dword [ebp - 0x28]
call fcn.0048b284
lea eax, [ebp - 0x18]
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
lea edx, [ebp - 0x1c]
inc dword [ebp - 0x28]
call fcn.00662c4c
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov dword [ebp - 0x20], ecx
lea edx, [ebp - 0x20]
inc dword [ebp - 0x28]
lea eax, [ebp + 8]
call fcn.00662c4c
lea edx, [ebp - 0x20]
pop eax
call fcn.00662b54
push eax
dec dword [ebp - 0x28]
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00662a80
dec dword [ebp - 0x28]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00662a80
dec dword [ebp - 0x28]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00662a80
dec dword [ebp - 0x28]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00662a80
pop ecx
test cl, cl
je 0x4229f0
mov byte [ebp - 0x49], 1
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x48]
call sub.KERNEL32.DLL_Process32NextW
test eax, eax
jne 0x42294a
mov al, byte [ebp - 0x49]
push eax
dec dword [ebp - 0x28]
lea eax, [ebp + 8]
mov edx, 2
call fcn.00662a80
pop eax
mov edx, dword [ebp - 0x44]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret
Function at 0x422cb8
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
mov eax, 0x6ad9e4
call fcn.00654e18
mov dword [ebp - 0x10], 1
lea edx, [ebp + 8]
lea eax, [ebp + 8]
call fcn.00662930
inc dword [ebp - 0x10]
mov word [ebp - 0x1c], 0xc
push 0x1e
push 0
lea edx, [ebp - 0x4c]
push edx
call fcn.006548f7
add esp, 0xc
mov ecx, dword [0x749280]
mov eax, dword [ecx]
mov edx, dword [eax + 0x170]
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x48], 3
mov word [ebp - 0x1c], 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push 0
push 0x6ad05e
lea eax, [ebp - 4]
push eax
call fcn.00662bd4
add esp, 0xc
inc dword [ebp - 0x10]
lea edx, [ebp - 4]
xor ecx, ecx
mov dword [ebp - 8], ecx
lea ecx, [ebp - 8]
inc dword [ebp - 0x10]
lea eax, [ebp + 8]
call fcn.00662ad0
cmp dword [ebp - 8], 0
je 0x422d4d
mov edx, dword [ebp - 8]
jmp 0x422d52
mov edx, 0x6ad064
mov dword [ebp - 0x44], edx
dec dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00662a80
dec dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00662a80
xor eax, eax
mov dword [ebp - 0x40], eax
mov word [ebp - 0x3c], 0x14
xor ecx, ecx
mov dword [ebp - 0x36], ecx
xor eax, eax
mov dword [ebp - 0x32], eax
lea edx, [ebp - 0x4c]
push edx
call sub.SHELL32.DLL_SHFileOperationW
dec dword [ebp - 0x10]
lea eax, [ebp + 8]
mov edx, 2
call fcn.00662a80
mov ecx, dword [ebp - 0x2c]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4230f4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbb0
mov eax, 0x6adc18
call fcn.00654e18
mov dword [ebp - 0x24], 1
lea edx, [ebp + 0xc]
lea eax, [ebp + 0xc]
call fcn.00662930
inc dword [ebp - 0x24]
mov word [ebp - 0x30], 0xc
mov word [ebp - 0x30], 0x18
lea edx, [ebp + 0xc]
lea eax, [ebp - 4]
call fcn.00662930
inc dword [ebp - 0x24]
mov word [ebp - 0x30], 0xc
mov word [ebp - 0x30], 0x24
mov edx, 0x6ad078
lea eax, [ebp - 8]
call fcn.006628f0
inc dword [ebp - 0x24]
mov word [ebp - 0x30], 0xc
mov dl, 1
mov eax, dword [ebp + 0xc]
call fcn.0048ac78
test al, al
jne 0x42328c
mov word [ebp - 0x30], 0x30
xor edx, edx
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0xc]
inc dword [ebp - 0x24]
mov eax, dword [ebp + 0xc]
call fcn.0048b1c8
lea eax, [ebp - 0xc]
mov eax, dword [eax]
mov dl, 1
call fcn.0048ac78
xor ecx, ecx
mov cl, al
cmp ecx, 1
sbb eax, eax
neg eax
push eax
dec dword [ebp - 0x24]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00662a80
pop ecx
test cl, cl
je 0x423219
push 1
push 5
lea eax, [ebp - 0x248]
push eax
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderPathW
mov word [ebp - 0x30], 0x3c
lea edx, [ebp - 0x248]
lea eax, [ebp - 0x10]
call fcn.00662a1c
inc dword [ebp - 0x24]
xor edx, edx
mov dword [ebp - 0x14], edx
lea ecx, [ebp - 0x14]
inc dword [ebp - 0x24]
lea edx, [ebp - 8]
call fcn.00662ad0
lea edx, [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.00662aa8
dec dword [ebp - 0x24]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00662a80
dec dword [ebp - 0x24]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00662a80
jmp 0x42328c
mov eax, dword [ebp + 0xc]
call fcn.0048ad44
test al, al
jne 0x42328c
push 1
push 5
lea edx, [ebp - 0x450]
push edx
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderPathW
mov word [ebp - 0x30], 0x48
lea edx, [ebp - 0x450]
lea eax, [ebp - 0x18]
call fcn.00662a1c
inc dword [ebp - 0x24]
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x1c]
inc dword [ebp - 0x24]
lea edx, [ebp - 8]
call fcn.00662ad0
lea edx, [ebp - 0x1c]
lea eax, [ebp - 4]
call fcn.00662aa8
dec dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00662a80
dec dword [ebp - 0x24]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00662a80
mov word [ebp - 0x30], 0x54
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.00662aa8
mov eax, dword [ebp + 8]
mov word [ebp - 0x30], 0x60
push eax
dec dword [ebp - 0x24]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00662a80
dec dword [ebp - 0x24]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00662a80
dec dword [ebp - 0x24]
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.00662a80
pop eax
mov word [ebp - 0x30], 0x54
inc dword [ebp - 0x24]
mov edx, dword [ebp - 0x40]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret
Function at 0x43abcc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x43ac1e
test eax, edx
je 0x43ac21
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x43abe1
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x43ac07
add ecx, 4
js 0x43abf7
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x43ac04
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x43ac2d
test edx, edx
jne 0x43abd4
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret
Function at 0x43dd00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
Function at 0x45f634
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x45f6d2
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xc]
je 0x45f696
cmp byte [ebx + 0x10], 0
jne 0x45f696
cmp byte [ebx + 0x3c], 0
jne 0x45f696
mov byte [ebx + 0xe], 0
mov byte [ebx + 0xc], 0
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_ResumeThread
cmp eax, 1
je 0x45f6b7
lea edx, [ebp - 4]
mov eax, dword [0x749020]
call fcn.004aaa60
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x44f530]
call fcn.0048fb50
call fcn.004a6488
jmp 0x45f6b7
lea edx, [ebp - 8]
mov eax, dword [0x749020]
call fcn.004aaa60
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x44f530]
call fcn.0048fb50
call fcn.004a6488
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f6d9
lea eax, [ebp - 8]
mov edx, 2
call fcn.004a6ce0
ret

Function at 0x45ffe0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xe]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x46002e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.KERNEL32.DLL_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.0045f580
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x460047
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x460050
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0045f580
dec esi
jne 0x460072
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x4618e8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x74a55c
cmp dword [edi], 0
jne 0x461964
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
mov eax, dword [0x74a558]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x71dc7c
mov ecx, 2
call fcn.004a489c
mov edx, 0x4618c0
lea eax, [esi + 5]
call fcn.004618e0
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004618e0
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x461939
mov dword [0x74a558], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x467180
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4672fb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004a70a8
mov eax, dword [ebp - 4]
call fcn.00466ae0
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x4671d2
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.004a7f60
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.00467d74
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4672b1
xor eax, eax
push ebp
push 0x4672aa
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00466d80
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.00467330
test al, al
je 0x467288
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.004a6e08
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x467288
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.004a7ae4
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.ADVAPI32.DLL_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.00466ce0
test al, al
je 0x467282
mov eax, dword [ebp - 8]
call fcn.004a7ae4
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.004a7b44
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.00467180
dec ebx
cmp ebx, 0xffffffff
jne 0x467231
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4672b1
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00466d80
mov eax, dword [ebp - 0x1c]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov eax, dword [ebp - 4]
call fcn.004a7ae4
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.00466d6c
push eax
call sub.ADVAPI32.DLL_RegDeleteKeyW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.00466ce0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467302
lea eax, [ebp - 0x3c]
call fcn.004a6c80
lea eax, [ebp - 8]
mov edx, 2
call fcn.004a6ce0
ret
Function at 0x46739c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x467454
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.00467330
test al, al
je 0x467436
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.004a6e08
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x467436
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004a7ae4
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.ADVAPI32.DLL_RegEnumKeyExW
mov eax, dword [ebp - 4]
call fcn.004a7ae4
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.004a7b44
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x4673ef
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46745b
lea eax, [ebp - 0x2c]
call fcn.004a6c80
lea eax, [ebp - 4]
call fcn.004a6c80
ret

Function at 0x46760c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4676c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.00467330
test al, al
je 0x4676a6
mov ecx, dword [ebp - 0x1c]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.004a6e08
mov ebx, dword [ebp - 0x20]
dec ebx
test ebx, ebx
jl 0x4676a6
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004a7ae4
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.ADVAPI32.DLL_RegEnumValueW
mov eax, dword [ebp - 4]
call fcn.004a7ae4
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.004a7b44
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x46765f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4676cb
lea eax, [ebp - 0x2c]
call fcn.004a6c80
lea eax, [ebp - 4]
call fcn.004a6c80
ret
Function at 0x467c50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.00466af8
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.004a7ae4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ADVAPI32.DLL_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.00466ce0
test al, al
jne 0x467cb8
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x748ff4]
mov dl, 1
mov eax, dword [0x4649ac]
call fcn.0048fd54
call fcn.004a6488
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x467cc4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.004a7ae4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExW
mov edx, eax
mov eax, ebx
call fcn.00466ce0
test al, al
jne 0x467d25
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x748fec]
mov dl, 1
mov eax, dword [0x4649ac]
call fcn.0048fd54
call fcn.004a6488
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00466b28
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8