joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ae5d
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x676314]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.004830b0
add esp, 0xc
mov dword [ebp - 0x120], esi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
call fcn.0047362e
test al, al
je 0x45aed3
test eax, esp
invalid
loope 0x45ae9e
out dx, eax
sbb esi, ecx
push esi
and edx, dword [edx + 0x7c]
jg 0x45af32
pop ebx
insb byte es:[edi], dx
pop edi
push ss
push edi
jp 0x45aeca
jmp 0x45af0c
test dword [ecx + 0x70], edi
ljmp 0xe853
call fcn.0047351a
test al, al
je 0x45aef3
pop esp
outsd dx, dword [esi]
out dx, eax
les edi, [eax]
and ebp, dword [ebp - 0x16]
imul byte [esi]
fucompi st(3)
or ch, 0xef
or eax, eax
sbb al, 0x21
lea ebp, [edx - 0x3617be56]
test byte [ecx], al
add byte [eax + eax*8 - 0x22e0e88c], al
invalid
call fcn.004733c1
test al, al
je 0x45af13
pop ds
fisttp qword [edi + 0x64273d5c]
mov edx, 0xdd176b0a
int 0xdf
fnstsw word [ecx - 0x219433f9]
mov ebp, 0x858ba79b
in al, 0xfe
invalid
pop es
int3
mov eax, dword [ebp - 0x11c]
mov edi, dword [ebp - 0x118]
mov dword [ebp - 0x124], eax
call fcn.00473856
test al, al
je 0x45af40
out 0xe6, eax
ret
push ds
mov byte es:[0x58de33c3], al
mov al, 0xb6
or dword [eax], ecx
add eax, 0xbd833eb4
fdiv st(6), st(0)
invalid
cmp dword [ebp - 0x124], 5
jg 0x45af53
cmp edi, 2
jg 0x45af53
xor eax, eax
inc eax
jmp 0x45af55
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046ce06
mov esp, ebp
pop ebp
ret

Function at 0x45b5d2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x38
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], 0x3c
push 0
push eax
call fcn.004830b0
mov eax, dword [ebp + 8]
add esp, 0xc
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x2c], eax
mov eax, 0x200
mov dword [ebp - 0x20], 1
lea ecx, [eax + 0x40]
cmovne eax, ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
call fcn.0045ae5d
test eax, eax
mov ecx, str.runas
lea eax, [ebp - 0x3c]
cmovne ecx, dword [ebp - 0x30]
push eax
mov dword [ebp - 0x30], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x45b63f
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x45b654
cmp dword [ebp + 0x10], 0
je 0x45b651
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
inc eax
mov esp, ebp
pop ebp
ret
Function at 0x45cc69
Capabilities:
Get disk information
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa38
mov eax, dword [0x676314]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push ebx
push 0x5e87f0
mov dword [ebp - 0xa38], eax
call fcn.00402650
push 0x20a
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004830b0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x105
push eax
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
jne 0x45cccb
xor al, al
jmp 0x45ce89
push ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
call ebx
mov esi, eax
test esi, esi
je 0x45ccc4
push edi
xor ecx, ecx
lea eax, [esi + 1]
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046ce17
mov edi, eax
pop ecx
test edi, edi
je 0x45cd40
lea eax, [esi*2 + 2]
push eax
push 0
push edi
call fcn.004830b0
add esp, 0xc
push edi
push esi
call ebx
test eax, eax
je 0x45cd39
mov eax, dword [0x5eef24]
mov ebx, 0x208
mov dword [ebp - 0xc], eax
mov ax, word [0x5eef28]
push ebx
mov word [ebp - 8], ax
call fcn.0046ce17
mov esi, eax
pop ecx
test esi, esi
jne 0x45cd47
push edi
call fcn.0046ce20
pop ecx
xor al, al
jmp 0x45ce88
push ebx
push 0
push esi
call fcn.004830b0
add esp, 0xc
mov ebx, edi
mov ax, word [ebx]
push 0x104
mov word [ebp - 0xc], ax
lea eax, [ebp - 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x45cdcc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x45ce74
push esi
call fcn.0046ce20
xor eax, eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046ce17
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x45ce74
push 2
pop eax
push eax
push 0
push esi
call fcn.004830b0
add esp, 0xc
lea eax, [ebp - 0xc]
push 1
push esi
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x45ce74
push esi
call fcn.00491757
push eax
mov dword [ebp - 0xa34], eax
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.0048f08d
add esp, 0x10
test eax, eax
je 0x45ce07
push 2
pop ecx
mov ax, word [ebx]
add ebx, ecx
test ax, ax
jne 0x45cdf0
xor eax, eax
cmp word [ebx], ax
jne 0x45cd55
jmp 0x45ce74
push 0x800
xor ebx, ebx
lea eax, [ebp - 0xa18]
push ebx
push eax
call fcn.004830b0
mov eax, dword [ebp - 0xa34]
lea ecx, [ebp - 0x218]
lea eax, [ecx + eax*2]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x5ebf3c
lea eax, [ebp - 0xa18]
push 0x400
push eax
call fcn.0045fc48
add esp, 0x20
lea eax, [ebp - 0xa18]
lea ecx, [ebp - 0xa30]
push eax
call fcn.00403b30
mov ecx, dword [ebp - 0xa38]
push eax
call fcn.00403d40
push ebx
push 1
lea ecx, [ebp - 0xa30]
call fcn.0041f8c0
push edi
call fcn.0046ce20
pop ecx
test esi, esi
je 0x45ce86
push esi
call fcn.0046ce20
pop ecx
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0046ce06
mov esp, ebp
pop ebp
ret
Function at 0x45ce99
Capabilities:
Enumerate processes

Disassembly:
push 0x46c
mov eax, 0x5e41c1
call fcn.0046d2ba
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x230]
xor ebx, ebx
mov dword [ebp - 0x21c], 7
push ebx
xor eax, eax
mov dword [ebp - 0x478], ebx
push 0x5e87f0
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
call fcn.00402650
mov esi, 0x22c
mov dword [ebp - 4], ebx
push esi
lea eax, [ebp - 0x474]
push ebx
push eax
call fcn.004830b0
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x45cf16
push 0x5e87f0
mov ecx, edi
call fcn.00403b30
jmp 0x45d0ac
lea eax, [ebp - 0x474]
mov dword [ebp - 0x474], esi
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x45d097
mov esi, dword [ebp + 0xc]
and dword [ebp - 0x238], 0
xor eax, eax
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], ax
cmp word [ebp - 0x450], ax
je 0x45cf64
lea eax, [ebp - 0x450]
push eax
call fcn.00491757
pop ecx
push eax
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x248]
call fcn.00402650
mov byte [ebp - 4], 1
cmp dword [ebp - 0x46c], esi
je 0x45cfac
push 0
push 1
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0
call fcn.0041f8c0
lea eax, [ebp - 0x474]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x45cf34
jmp 0x45d097
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004830b0
add esp, 0xc
push dword [ebp - 0x46c]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x45d088
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
cmp word [ebp - 0x218], 0
jne 0x45d001
xor eax, eax
jmp 0x45d00e
lea eax, [ebp - 0x218]
push eax
call fcn.00491757
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402650
push 0x5e87f0
lea ecx, [ebp - 0x230]
call fcn.00429920
test eax, eax
jne 0x45d081
lea eax, [ebp - 0x230]
push eax
push esi
call fcn.0045cc69
pop ecx
pop ecx
push 0x5e87f0
lea ecx, [ebp - 0x230]
call fcn.00429920
test eax, eax
jne 0x45d081
cmp word [ebp - 0x450], ax
je 0x45d06e
lea eax, [ebp - 0x450]
push eax
call fcn.00491757
pop ecx
push eax
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402650
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 1
lea ecx, [ebp - 0x248]
call fcn.0041f8c0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.00454193
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.0041f8c0
mov eax, edi
call fcn.0046d264
ret
Function at 0x45d3bd
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x676314]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x214], 0
lea eax, [ebp - 0x20c]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0x208
push 0
push eax
call fcn.004830b0
add esp, 0xc
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x45d442
lea eax, [ebp - 0x218]
push eax
push 4
lea eax, [ebp - 0x210]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x45d43b
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.00403b30
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0046ce06
mov esp, ebp
pop ebp
ret
Function at 0x464c1c
Capabilities:
Link function at runtime on windows
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
push str.kernel32.dll
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
call fcn.0047337c
test al, al
je 0x464c58
and eax, 0x14ccb37
fild dword [ebp - 0x5b5fb680]
pop ds
cwde
std
push ds
out dx, eax
xor dword [ebx + 0x23c117c3], ebp
rcl byte [ebx + 0x2e8890f], 0xe9
add byte [eax], al
call fcn.0047355f
test al, al
je 0x464c77
inc ebp
invalid
call fcn.004734d5
test al, al
je 0x464c98
xor cl, ah
sub ecx, dword [edi + eax - 0x7d]
fcmovu st(0), st(6)
insd dword es:[edi], dx
sub al, byte [eax + 0x47]
invalid
call fcn.00473925
test al, al
je 0x464cbb
int1
cmp dword [ebx + 0x154cf7ed], 0xb2e8370d
xchg edi, eax
neg dword [edx - 0x3a]
add ah, bh
js 0x464d1b
dec ecx
jnp 0x464d1f
test byte [edi + 0x4d], 0x8b
jne 0x464cba
dec ebp
mov esi, dword [ebp - 4]
cmp dword [esi], 0
jne 0x464cca
xor eax, eax
jmp 0x464da6
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5eee40
push dword [esi]
call ebx
add byte [eax + 0x40], ch
out dx, al
pop esi
add bh, bh
call ebx
push str.IsWow64Process
push dword [esi]
mov dword [esi + 8], eax
call ebx
push str.Wow64DisableWow64FsRedirection
push dword [esi]
mov dword [esi + 0xc], eax
call ebx
push str.Wow64RevertWow64FsRedirection
push dword [esi]
mov dword [esi + 0x18], eax
call ebx
push 0x5f019c
push dword [esi]
mov dword [esi + 0x14], eax
call ebx
push str.advapi32.dll
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 4], eax
call fcn.0047337c
pop ebp
out 0, al
add byte [eax + eax*8 - 0x7a47e28c], al
push ecx
fld dword [ebp + edi*4 - 0x69]
jae 0x464ccf
test al, al
je 0x464d40
mov eax, 0x44d95185
mov ebp, 0x34a37397
inc ecx
xor al, 0x41
adc eax, 0x12c2bd29
movq mm1, mm4
das
mov eax, dword [0x71019a63]
hlt
call fcn.004736b8
test al, al
je 0x464d5a
sal byte [ecx + edx - 0x1f], 0x53
loope 0x464d9e
sub eax, 0x7b90ceaf
sub byte [eax - 0x2e], al
jns 0x464ce3
mov word [ebp - 0x177d0ab3], es
jecxz 0x464d46
call fcn.00473742
add byte [eax], al
test al, al
je 0x464d7a
xor bh, byte [esi - 0xc]
loopne 0x464dba
jg 0x464dda
mov al, 0xeb
cdq
enter 0xffffffffffffaf68, 0xffffffffffffffa3
punpckhdq mm4, qword [esi - 0x6ef52c6c]
and byte [ebx + eax*4 + 0x7e], bh
add al, 0
cmp dword [esi + 4], 0
je 0x464cc3
mov ebx, str.Wow64RevertWow64FsRedirection
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push dword [esi + 4]
mov dword [esi + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x1c], eax
xor eax, eax
pop esi
add byte [ecx - 0x3fcce3ba], cl
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
sal byte [ebp + eax + 0x33], 0xc0
inc eax
jmp 0x464de4
pop ebp
ret 4
Function at 0x464e2e
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x24c
mov eax, 0x5e4f14
call fcn.0046d2ba
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
and dword [ebp - 0x24c], 0
push 0x208
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x218]
push 0
push eax
mov dword [ebp - 0x258], ebx
call fcn.004830b0
add esp, 0xc
call fcn.0047344b
test al, al
je 0x464e85
aam 0x3e
salc
shl dword [edx + 0x1d3e0c75], 1
pop ds
int3
push 0x104
lea eax, [ebp - 0x218]
xor esi, esi
push eax
push esi
jmp 0x464fd3
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x464fc5
call fcn.004732ad
test al, al
je 0x464ecf
pop es
add al, 0xec
pop esi
dec ebx
mov dh, 0xca
mov bh, 0xc9
inc eax
stosb byte es:[edi], al
push eax
popal
out 0xbc, eax
call fcn.004735e9
test al, al
je 0x464ee8
pop edx
xchg ebp, eax
lahf
inc edi
adc cl, byte [ebx - 0x59d1fc66]
inc esi
sbb eax, 0xafbcf6d
call fcn.004732ad
test al, al
je 0x464f09
push eax
mov al, 0xaa
jae 0x464f3e
dec esi
pop edi
jo 0x464f52
cmp eax, dword [edi - 0x56]
call 0x62359616
imul ebp, dword [eax], 0x3f
sub al, 0x4e
aas
and dword [ebp - 0x220], 0
xor eax, eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
je 0x464f39
lea eax, [ebp - 0x218]
push eax
call fcn.00491757
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402650
and dword [ebp - 4], 0
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.00458263
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.0041f8c0
cmp dword [ebp - 0x234], 0x10
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push eax
push dword [ebp - 0x254]
call fcn.0045f65c
pop ecx
pop ecx
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
push 0
push 1
call fcn.0040ca30
mov ebx, dword [ebp - 0x258]
mov esi, dword [ebp - 0x250]
invalid
sar ch, 1
invalid
push 0x104
lea eax, [ebp - 0x218]
inc esi
push eax
push esi
push ebx
mov dword [ebp - 0x250], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x464e99
call fcn.0046d264
ret
Function at 0x465c39
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
call fcn.00473811
test al, al
je 0x465c6f
mov edi, 0xc5db0e03
cmp dword [edx], ebp
stc
std
in al, dx
dec esp
cmc
aas
mov ch, 0x27
cmpsb byte [esi], byte es:[edi]
stc
mov byte [ecx], dh
xor esi, esi
call fcn.0047396a
test al, al
je 0x465c89
add edi, dword [0x1e2b4b6b]
rcl byte [esi + 0x4c83b119]
mov cs, word [ecx - 0x72a04e9c]
inc ebp
cld
lea eax, [ebp - 4]
mov ebx, 0xf013f
push eax
push ebx
push esi
push dword [ebp + 0xc]
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x465e1d
call fcn.00473742
test al, al
je 0x465ccc
out dx, al
rcl dword [ecx + 0x7f4de9ab], cl
push ds
mov es, eax
outsd dx, dword [esi]
dec ecx
adc eax, 0xd81668ad
cmp dword [ebx], esi
idiv byte [ebx + 0xf013f]
lea eax, [ebp - 8]
push eax
push ebx
push esi
push str.SoftWare
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x465cf2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x465e1d
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push ebx
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x465d21
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call esi
push dword [ebp - 4]
call esi
jmp 0x465e1d
call fcn.0047362e
test al, al
je 0x465d49
cli
or ebx, ebp
ret
call fcn.00473925
test al, al
je 0x465d71
popal
mov ebx, 0xdad74894
outsb dx, byte [esi]
sahf
sbb ch, ah
arpl word [ecx - 0x5cd22503], di
retf
xor esi, esi
lea eax, [ebp - 0x10]
push esi
push eax
push esi
push ebx
push esi
push esi
push esi
push dword [ebp + 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x465d9d
push dword [ebp - 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
jmp 0x465d12
push dword [ebp + 0x18]
call fcn.00491757
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0x18]
push 1
push esi
push dword [ebp + 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
push dword [ebp - 0xc]
call ebx
call fcn.004732f2
test al, al
je 0x465df4
push ss
call 0x97e7df92
js 0x465dd7
sub eax, 0xa67d42b3
sub ah, al
cdq
ret
call fcn.004738e0
test al, al
je 0x465e13
invalid
push dword [ebp - 8]
call ebx
push dword [ebp - 4]
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x465e24
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor eax, eax
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
call fcn.0047337c
test al, al
je 0x465e51
loopne 0x465e95
insd dword es:[edi], dx
retf
call fcn.0047355f
test al, al
je 0x465e6a
push ebx
mov dl, 0xa0
pop ecx
test al, 0xe0
cmpsd dword [esi], dword es:[edi]
bound ecx, qword [eax]
enter 0xffffffffffff8e33, 0xffffffffffffffa9
inc edi
rol dword [eax], cl
call fcn.00473811
test al, al
je 0x465e88
mov al, byte [0x799f32b2]
pop ss
sub dh, ch
ljmp 0xc34b
lea eax, [ebp - 0xc]
mov esi, 0xf013f
push eax
push esi
xor ebx, ebx
push ebx
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x465fc7
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push esi
push ebx
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x465ed5
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x465fc7
call fcn.00473742
test al, al
je 0x465ef7
push cs
inc edx
nop
and dword [eax - 0x63], eax
xchg ecx, eax
pop esp
mov dword [0x2ee7bf99], eax
pop esi
stosd dword es:[edi], eax
xor byte [esp + ebp + 0x33], dl
fstp xword [esi + 0xf013f]
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push esi
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x465f24
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
jmp 0x465fc5
push dword [ebp + 0x14]
call fcn.00491757
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0x14]
push 1
push ebx
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00473742
test al, al
je 0x465f71
frstor dword [ecx - 0x29]
sub eax, dword [edx - 0x6b]
jnp 0x465fc0
add al, 0x5d
std
and byte [ecx + 0x4d], dh
pop esi
pop ss
sub dword [eax + esi*2 + 0x63e3ab5e], 0xffffffe8
dec ebx
aam 0
add byte [eax + eax*8 - 0x3b58df8c], al
invalid
call fcn.004733c1
test al, al
je 0x465f9a
cmpsd dword [esi], dword es:[edi]
invalid
call fcn.0047389b
test al, al
je 0x465fb7
call 0x141e8794
mov eax, dword ds:[0xdbaf06e1]
inc edx
arpl word [ebx], ax
sahf
xor eax, 0x277b6a5a
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0xc]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x465fce
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
and dword [ebp - 8], 0
push ebx
push esi
push edi
call fcn.0047337c
test al, al
je 0x465ff7
dec esp
mov byte [ecx], bl
cli
inc ebx
les esp, [edx - 0x6f8bd14b]
mov cl, 0xdb
lodsb al, byte [esi]
aaa
pop esp
call fcn.0047355f
test al, al
je 0x466010
test dword [esi - 0x6e], 0x53aa2c61
and eax, dword [ecx + edi*4]
pop ss
adc edx, ecx
sub esp, ebp
cmpsb byte [esi], byte es:[edi]
call fcn.00473811
test al, al
je 0x46602e
test eax, 0x1770860
or dword [edx - 0x1e339238], esi
jp 0x465fcc
shr byte [ecx], cl
or ebp, dword [ecx - 0x6b480d7c]
lea eax, [ebp - 4]
inc ebp
cld
mov esi, 0xf013f
push eax
push esi
xor ebx, ebx
push ebx
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x466132
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push esi
push ebx
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x46607b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x466132
call fcn.00473742
test al, al
je 0x466098
and byte [ebp - 0x625523de], ah
into
fistp word [eax - 0x3b408ac2]
inc ebx
mov al, 0xa8
jnp 0x46602f
xor ebx, ebx
push dword [ebp + 0x10]
call fcn.00491757
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0x10]
push 1
push ebx
push dword [ebp + 0xc]
add dword [ebx - 1], edx
jne 0x4660be
or al, 0xff
jne 0x4660ad
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call fcn.00473742
add byte [eax], al
test al, al
je 0x4660dc
push 0x70
fstpnce st(1), st(0)
fnstenv [eax - 0x188def78]
daa
adc al, 0x47
push esp
jle 0x4660c0
pop edi
xlatb
adc dword [esi], edx
fbstp tbyte [edx - 0xb]
sub ebp, eax
loopne 0x4660b1
call fcn.004733c1
add byte [eax], al
test al, al
je 0x466105
cdq
ret 0xfcec
call fcn.0047389b
test al, al
je 0x466122
lds ecx, [ebp - 0x3f]
adc byte [ebp + 0x72177dc4], bh
add dword [ebx + 0x79778d40], ecx
bound edi, qword [edx]
fistp dword [eax - 0x41]
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4663da
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, dword [ebp + 0xc]
push edi
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00403b30
call fcn.0045a0e1
and dword [ebp - 0x24], 0
lea edi, [ebp - 0x20]
add esp, 0x18
xor eax, eax
push 6
pop ecx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, 0x614
mov word [ebp - 0x14], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], 2
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8