joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4572f0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
push edi
cmp esi, 3
jne 0x45736c
mov edi, 0x20206
mov eax, reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 4]
push ecx
push edi
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
test edi, edi
jne 0x4573ec
push 0x594544
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov edi, eax
cmp edi, 2
jne 0x4573e1
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0056ce40
add esp, 0xc
cmp esi, 3
jne 0x4573bf
mov eax, 0x200
jmp 0x4573cc
cmp esi, 4
jne 0x457378
mov edi, 0x20106
jmp 0x457313
mov edi, 0x20006
test esi, esi
je 0x457313
cmp esi, 1
jne 0x45738d
mov eax, closesocket
jmp 0x457318
cmp esi, 2
jne 0x45739c
mov eax, closesocket
jmp 0x457318
push str.Unhandled_eRegKeyRoot_passed_into_HKeyGet
push 0x184
push str.c:_buildslave_steam_rel_client_hotfix_win32_build_srccommon_registry.cpp
call fcn.00476d20
add esp, 0xc
test al, al
jne 0x4573b8
int3
xor eax, eax
jmp 0x457318
xor eax, eax
mov ecx, 0x100
cmp esi, 4
cmove eax, ecx
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 4]
call fcn.00458040
add esp, 0xc
mov edi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x457400
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
cmp eax, 3
jne 0x457466
mov edi, 0x20206
mov eax, reloc.OLEAUT32.dll_SysReAllocString
push 0
lea ecx, [ebp - 4]
push ecx
push 0
push edi
push 0
push 0
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edi, eax
test edi, edi
jne 0x45745a
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 4
jne 0x457472
mov edi, 0x20106
jmp 0x457421
mov edi, 0x20006
test eax, eax
je 0x457421
cmp eax, 1
jne 0x457487
mov eax, closesocket
jmp 0x457426
cmp eax, 2
jne 0x457493
mov eax, closesocket
jmp 0x457426
push str.Unhandled_eRegKeyRoot_passed_into_HKeyGet
push 0x184
push str.c:_buildslave_steam_rel_client_hotfix_win32_build_srccommon_registry.cpp
call fcn.00476d20
add esp, 0xc
test al, al
jne 0x4574af
int3
xor eax, eax
jmp 0x457426
Function at 0x4574c0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
push edi
mov edi, dword [ebp + 0xc]
cmp eax, 3
jne 0x45752f
mov esi, 0x208
mov eax, reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 4]
push ecx
push esi
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x457524
mov eax, dword [ebp + 0x18]
push 0
push 0
push 0
push 0
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push dword [ebp - 4]
test eax, eax
cmove ebx, dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp eax, 4
jne 0x45753b
mov esi, 0x108
jmp 0x4574dc
mov esi, 8
test eax, eax
je 0x4574dc
cmp eax, 1
jne 0x457550
mov eax, closesocket
jmp 0x4574e1
cmp eax, 2
jne 0x45755c
mov eax, closesocket
jmp 0x4574e1
push str.Unhandled_eRegKeyRoot_passed_into_HKeyGet
push 0x184
push str.c:_buildslave_steam_rel_client_hotfix_win32_build_srccommon_registry.cpp
call fcn.00476d20
add esp, 0xc
test al, al
jne 0x457578
int3
xor eax, eax
jmp 0x4574e1

Function at 0x457580
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
push edi
mov edi, dword [ebp + 0xc]
cmp eax, 3
jne 0x4575f0
mov esi, 0x201
mov eax, reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 4]
push ecx
push esi
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4575e5
mov eax, dword [ebp + 0x18]
push 0
push 0
push dword [ebp + 0x1c]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push dword [ebp - 4]
test eax, eax
cmove ebx, dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 4
jne 0x4575fc
mov esi, 0x101
jmp 0x45759c
mov esi, 1
test eax, eax
je 0x45759c
cmp eax, esi
jne 0x457610
mov eax, closesocket
jmp 0x4575a1
cmp eax, 2
jne 0x45761c
mov eax, closesocket
jmp 0x4575a1
push str.Unhandled_eRegKeyRoot_passed_into_HKeyGet
push 0x184
push str.c:_buildslave_steam_rel_client_hotfix_win32_build_srccommon_registry.cpp
call fcn.00476d20
add esp, 0xc
test al, al
jne 0x457638
int3
xor eax, eax
jmp 0x4575a1
Function at 0x457890
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp eax, 3
jne 0x4578f7
mov esi, 0x201
mov eax, reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 4]
push ecx
push esi
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4578ec
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push eax
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 4
jne 0x457903
mov esi, 0x101
jmp 0x4578ad
mov esi, 1
test eax, eax
je 0x4578ad
cmp eax, esi
jne 0x457917
mov eax, closesocket
jmp 0x4578b2
cmp eax, 2
jne 0x457923
mov eax, closesocket
jmp 0x4578b2
push str.Unhandled_eRegKeyRoot_passed_into_HKeyGet
push 0x184
push str.c:_buildslave_steam_rel_client_hotfix_win32_build_srccommon_registry.cpp
call fcn.00476d20
add esp, 0xc
test al, al
jne 0x45793f
int3
xor eax, eax
jmp 0x4578b2

Function at 0x457950
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
cmp eax, 3
jne 0x4579cc
mov edi, 0x20219
mov eax, reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 4]
push ecx
push edi
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
test edi, edi
jne 0x4579c0
push dword [ebp + 0x18]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push dword [ebp + 0x14]
push eax
push edi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
jne 0x4579b5
cmp dword [ebp + 8], 3
mov eax, 1
cmovne edi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp eax, 4
jne 0x4579d8
mov edi, 0x20119
jmp 0x457971
mov edi, 0x20019
test eax, eax
je 0x457971
cmp eax, 1
jne 0x4579ed
mov eax, closesocket
jmp 0x457976
cmp eax, 2
jne 0x4579fc
mov eax, closesocket
jmp 0x457976
push str.Unhandled_eRegKeyRoot_passed_into_HKeyGet
push 0x184
push str.c:_buildslave_steam_rel_client_hotfix_win32_build_srccommon_registry.cpp
call fcn.00476d20
add esp, 0xc
test al, al
jne 0x457a18
int3
xor eax, eax
jmp 0x457976
Function at 0x457ae0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
cmp eax, 3
jne 0x457b66
mov edi, 0x20219
mov eax, reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 4]
push ecx
push edi
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
test edi, edi
jne 0x457b5a
mov dword [ebp + 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
lea eax, [ebp + 8]
mov dword [ebp - 8], 4
push eax
push edi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
jne 0x457b4f
cmp dword [ebp + 8], 4
mov eax, 1
cmovne edi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 4
jne 0x457b72
mov edi, 0x20119
jmp 0x457b03
mov edi, 0x20019
test eax, eax
je 0x457b03
cmp eax, 1
jne 0x457b87
mov eax, closesocket
jmp 0x457b08
cmp eax, 2
jne 0x457b96
mov eax, closesocket
jmp 0x457b08
push str.Unhandled_eRegKeyRoot_passed_into_HKeyGet
push 0x184
push str.c:_buildslave_steam_rel_client_hotfix_win32_build_srccommon_registry.cpp
call fcn.00476d20
add esp, 0xc
test al, al
jne 0x457bb2
int3
xor eax, eax
jmp 0x457b08

Function at 0x457bc0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp eax, 3
jne 0x457c29
mov esi, 0x201
mov eax, reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 4]
push ecx
push esi
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x457c1e
push eax
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret 0x14
cmp eax, 4
jne 0x457c35
mov esi, 0x101
jmp 0x457bdd
mov esi, 1
test eax, eax
je 0x457bdd
cmp eax, esi
jne 0x457c49
mov eax, closesocket
jmp 0x457be2
cmp eax, 2
jne 0x457c55
mov eax, closesocket
jmp 0x457be2
push str.Unhandled_eRegKeyRoot_passed_into_HKeyGet
push 0x184
push str.c:_buildslave_steam_rel_client_hotfix_win32_build_srccommon_registry.cpp
call fcn.00476d20
add esp, 0xc
test al, al
jne 0x457c71
int3
xor eax, eax
jmp 0x457be2
Function at 0x457de0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
cmp eax, 3
jne 0x457e4f
mov edi, 0x20206
mov eax, reloc.OLEAUT32.dll_SysReAllocString
push 0
lea ecx, [ebp - 4]
push ecx
push 0
push edi
push 0
push 0
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edi, eax
test edi, edi
jne 0x457e43
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 3
push eax
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp eax, 4
jne 0x457e5b
mov edi, 0x20106
jmp 0x457e01
mov edi, 0x20006
test eax, eax
je 0x457e01
cmp eax, 1
jne 0x457e70
mov eax, closesocket
jmp 0x457e06
cmp eax, 2
jne 0x457e7c
mov eax, closesocket
jmp 0x457e06
push str.Unhandled_eRegKeyRoot_passed_into_HKeyGet
push 0x184
push str.c:_buildslave_steam_rel_client_hotfix_win32_build_srccommon_registry.cpp
call fcn.00476d20
add esp, 0xc
test al, al
jne 0x457e98
int3
xor eax, eax
jmp 0x457e06

Function at 0x457f70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp + 0x14], 0
push edi
cmp eax, 3
jne 0x457fe5
mov edi, 0x20206
mov eax, reloc.OLEAUT32.dll_SysReAllocString
push 0
lea ecx, [ebp + 0x14]
push ecx
push 0
push edi
push 0
push 0
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edi, eax
test edi, edi
jne 0x457fd9
push 4
lea eax, [ebp - 4]
push eax
push 4
push edi
push esi
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x14]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 4
jne 0x457ff1
mov edi, 0x20106
jmp 0x457f97
mov edi, 0x20006
test eax, eax
je 0x457f97
cmp eax, 1
jne 0x458006
mov eax, closesocket
jmp 0x457f9c
cmp eax, 2
jne 0x458012
mov eax, closesocket
jmp 0x457f9c
push str.Unhandled_eRegKeyRoot_passed_into_HKeyGet
push 0x184
push str.c:_buildslave_steam_rel_client_hotfix_win32_build_srccommon_registry.cpp
call fcn.00476d20
add esp, 0xc
test al, al
jne 0x45802e
int3
xor eax, eax
jmp 0x457f9c
Function at 0x458040
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
sub esp, 0x114
mov ecx, dword [0x6acca8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x62e158]
cmp eax, dword [ecx + 4]
jg 0x458173
mov eax, dword [0x62e154]
test eax, eax
jne 0x45807b
mov eax, 1
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0
push ebx
push edi
push esi
call eax
test eax, eax
je 0x4580b1
lea eax, [ebp - 8]
push eax
mov eax, ebx
or eax, 0x20019
push eax
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4580ba
cmp eax, 2
jne 0x4580b3
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4580c0
sub ecx, edx
cmp byte [ecx + edi - 1], 0x5c
lea esi, [ecx + edi]
je 0x4580d9
mov byte [esi], 0x5c
inc esi
mov byte [esi], al
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x104
push eax
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x458152
push 0x104
lea eax, [ebp - 0x114]
push eax
push esi
call fcn.00575e40
push ebx
push edi
push dword [ebp + 8]
call fcn.00458040
add esp, 0x18
test eax, eax
jne 0x458152
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x104
push eax
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x458104
mov byte [esi - 1], 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push ebx
push edi
push dword [ebp + 8]
call dword [0x62e154]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x62e158
call fcn.0056b8ad
add esp, 4
cmp dword [0x62e158], 0xffffffff
jne 0x458069
push str.RegDeleteKeyExA
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x62e158
mov dword [0x62e154], eax
call fcn.0056b863
add esp, 4
jmp 0x458069
Function at 0x459700
Capabilities:
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5919d5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push esi
push edi
push 0
push 0
push 0
lea ecx, [ebp - 0x48]
xor bl, bl
call fcn.0046b5f0
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x48]
push 0
push 0
push eax
push ecx
mov eax, esp
mov dword [ebp - 4], 0
mov dword [eax], esi
call fcn.00471bd0
add esp, 0x10
test al, al
je 0x459962
push 0
lea ecx, [ebp - 0x48]
call fcn.0046c1b0
push 0
push 0
call fcn.00579c92
add esp, 8
mov dword [ebp + 8], eax
test esi, esi
mov dword [ebp - 0x1c], 0
mov ecx, 0x594544
mov dword [ebp - 0x18], 0
cmovne ecx, esi
mov dword [ebp - 0x14], 0x4000000
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.00459980
push 0
push eax
push 0
call fcn.00576374
add esp, 0xc
mov byte [ebp - 4], 0
cmp byte [ebp - 0x14], 0
mov edi, eax
je 0x4597c0
push dword [ebp - 0x20]
call fcn.0056b524
add esp, 4
cmp byte [ebp - 0x13], 0
je 0x4597d1
push dword [ebp - 0x1c]
call fcn.0056b524
add esp, 4
cmp byte [ebp - 0x12], 0
je 0x4597e2
push dword [ebp - 0x18]
call fcn.0056b524
add esp, 4
cmp dword [ebp + 8], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0x4000000
je 0x459951
test edi, edi
je 0x459951
push 0x5c
push edi
call fcn.0056d927
add esp, 8
test eax, eax
je 0x459951
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor ecx, ecx
push edi
mov word [eax], cx
call esi
push edi
push str.INSTALLDIR
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov al, byte [ebp + 0x10]
mov ecx, 0x629080
mov word [0x62909c], 0
mov byte [0x62909c], al
mov al, byte [ebp + 0x14]
mov dword [0x629094], 0
mov byte [0x62909d], al
mov eax, dword [ebp + 0xc]
mov word [0x6290de], 0
mov byte [0x6290e0], 0
mov dword [0x629098], 0
mov byte [0x62909e], 0x30
mov dword [0x629118], 0
mov dword [0x629114], 0
mov dword [0x629094], eax
call fcn.004588f0
mov al, byte [0x62909c]
mov ecx, 0x629080
mov edx, dword [ebp - 0x44]
mov byte [0x6290e1], al
mov byte [0x6290e2], al
mov eax, dword [0x629094]
mov dword [0x629098], eax
mov eax, dword [ebp - 0x34]
add eax, edx
mov dword [0x6290fc], 0
mov dword [0x629100], 0
mov dword [0x6290ec], 0x62909e
mov dword [0x6290e8], 0
mov dword [0x6290f0], 0
mov dword [0x6290f4], 0
mov dword [0x6290e4], 1
mov byte [0x6290e3], 0
mov dword [0x6290f8], 0
mov byte [0x62909e], 0
mov dword [0x629084], edx
mov dword [0x629088], edx
mov dword [0x62908c], eax
push 0
mov byte [0x629090], 0
call fcn.00458cf0
push dword [ebp + 8]
mov bl, al
call esi
push edi
call fcn.00575f64
push dword [ebp + 8]
call fcn.00575f64
add esp, 8
lea ecx, [ebp - 0x48]
call fcn.0046a620
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45d9f0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x591cdd
push eax
mov dword fs:[0], esp
sub esp, 0x68
cmp byte [0x62e7d0], 0
push ebx
push esi
je 0x45db9a
mov eax, dword [0x62eae0]
test eax, eax
je 0x45db9a
cmp byte [eax], 0
je 0x45db9a
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesEventLogApplicationSteam_Client_Service
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x45daa7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
lea ecx, [ebp - 0x4c]
mov esi, eax
call fcn.0045aaf0
push esi
push str.Could_not_create_the_registry_key_for_event_log_source:_gle:__u_n
lea ecx, [eax + 0x20]
push ecx
lea ecx, [eax + 8]
push ecx
push eax
push 1
push 1
push 1
push 4
push 0
push 0
call fcn.0045e970
add esp, 0x2c
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x62eae0]
mov ecx, 0x594544
test eax, eax
cmovne ecx, eax
push ecx
mov eax, esp
push ecx
lea ecx, [ebp - 0x24]
mov dword [eax], 0x62e7d0
call fcn.00470340
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
call fcn.004719f0
push eax
push str.EventMessageFile
push dword [ebp - 0x10]
call fcn.00463fd0
add esp, 0xc
test eax, eax
je 0x45daff
push 0
push 0
lea ecx, [ebp - 0x4c]
call fcn.0045aaf0
push str.Could_not_set_the_event_message_file._n
jmp 0x45db33
push 4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 7
push eax
push 4
push 0
push str.TypesSupported
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x45db75
push 0
push 0
lea ecx, [ebp - 0x74]
call fcn.0045aaf0
push str.Could_not_set_the_supported_types_for_event_log_source._n
lea ecx, [eax + 0x20]
push ecx
lea ecx, [eax + 8]
push ecx
push eax
push 1
push 1
push 1
push 4
push 0
push 0
call fcn.0045e970
add esp, 0x28
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x24]
xor bl, bl
call fcn.004707c0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x24]
mov bl, 1
call fcn.004707c0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.Could_not_get_path_to_current_executable_n
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x4c]
push eax
push 1
push 1
push 1
push 4
push 0
push 0
call fcn.0045e970
mov ecx, dword [ebp - 0xc]
add esp, 0x28
xor al, al
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45eaf0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45eb2c
test al, 3
je 0x45eb1c
and eax, 0xfffffffc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp eax, 1
sete al
test al, al
je 0x45eb2c
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
pop esi
sete al
pop ebp
ret
xor al, al
pop esi
pop ebp
ret

Function at 0x45eb40
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45ebaa
test al, 3
je 0x45eb6d
and eax, 0xfffffffc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp eax, 1
sete al
test al, al
je 0x45ebaa
mov edi, dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45eb95
test al, 3
je 0x45eb95
and eax, 0xfffffffc
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp eax, 1
sete al
test al, al
je 0x45ebaa
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp eax, 1
pop edi
sete al
pop esi
pop ebp
ret
pop edi
xor al, al
pop esi
pop ebp
ret
Function at 0x45f210
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push 0
push dword [ebp + 8]
xor bl, bl
mov byte [ebp - 1], bl
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x45f355
call fcn.0047f4e0
mov ecx, eax
push esi
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ebx, eax
push ebx
push esi
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x45f33d
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0
push eax
push str.StringFileInfo040904b0OriginalFilename
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x45f33d
mov ecx, dword [ebp + 0xc]
mov edx, ecx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x45f285
sub edx, esi
mov esi, dword [ebp - 8]
sar edx, 1
lea eax, [edx + 1]
cmp esi, eax
jne 0x45f33d
mov edx, dword [ebp - 0xc]
add esi, esi
sub esi, 4
jb 0x45f2c1
lea esp, [esp]
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x45f2c6
add edx, 4
add ecx, 4
sub esi, 4
jae 0x45f2b0
cmp esi, 0xfffffffc
je 0x45f2f3
mov al, byte [edx]
cmp al, byte [ecx]
jne 0x45f33d
cmp esi, 0xfffffffd
je 0x45f2f3
mov al, byte [edx + 1]
cmp al, byte [ecx + 1]
jne 0x45f33d
cmp esi, 0xfffffffe
je 0x45f2f3
mov al, byte [edx + 2]
cmp al, byte [ecx + 2]
jne 0x45f33d
cmp esi, 0xffffffff
je 0x45f2f3
mov al, byte [edx + 3]
cmp al, byte [ecx + 3]
jne 0x45f33d
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 0
push eax
lea eax, [ebp - 0x10]
push eax
push 0x5b2114
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x45f33d
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x45f33d
cmp dword [ebp - 8], 0x34
jb 0x45f33d
mov edx, dword [ebp + 0x10]
xor ecx, ecx
mov esi, dword [eax + 8]
or ecx, esi
mov byte [ebp - 1], 1
mov dword [edx], 0
mov dword [edx + 4], esi
mov eax, dword [eax + 0xc]
mov dword [edx], eax
mov dword [edx + 4], ecx
call fcn.0047f4e0
push 0
push ebx
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret