joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441d57
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4a13b4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edx
push ecx
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_towupper]
push esi
movzx ebx, ax
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_towupper]
pop ecx
pop ecx
cmp bx, ax
jne 0x441d9d
push dword [ebp + 8]
mov edx, 0x104
mov ecx, edi
call fcn.0042f10c
jmp 0x441e0a
mov dword [ebp - 0x10], 0x3a0020
lea eax, [ebp - 0x21c]
mov word [ebp - 0x10], bx
mov ebx, 0x104
push ebx
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 0x5c
push eax
call dword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
jne 0x441dd3
call fcn.00478a37
test eax, eax
js 0x441e0a
lea eax, [ebp - 0x21c]
push 0x7b
push eax
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x441df1
mov eax, 0x8000ffff
jmp 0x441e0a
push dword [ebp + 8]
mov edx, ebx
mov ecx, edi
call fcn.0042f10c
test eax, eax
js 0x441e0a
push ecx
push esi
mov ecx, edi
call fcn.00441f6f
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042bef0
leave
ret 0xc

Function at 0x4458d7
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 1
push esi
push 0x409cd4
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x44594a
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push esi
push 0x409cc4
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x445941
cmp dword [ebp - 8], 4
jne 0x445941
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x44593e
mov eax, dword [ebp - 0xc]
mov dword [ecx], eax
xor esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 4

Function at 0x4461ac
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov ecx, edx
push esi
push edi
call fcn.0042f512
mov edx, dword [edx + 0x10]
mov edi, eax
mov esi, 0x811c9dc5
push 0
pop ecx
add edx, edx
je 0x4461df
movzx eax, byte [edi + ecx]
xor eax, esi
imul esi, eax, 0x1000193
inc ecx
cmp ecx, edx
jb 0x4461ce
pop edi
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x4509ec
Capabilities:
Reference sql statements

Disassembly:
push 0x1cc
mov eax, 0x46de14
call fcn.00467994
mov ebx, edx
mov edx, ecx
push 0x5d
pop ecx
mov esi, 0x40c9c8
lea edi, [ebp - 0x1b8]
rep movsd dword es:[edi], dword [esi]
push 0xb
pop ecx
mov esi, 0x40c994
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor esi, esi
mov dword [ebp - 0x1c4], esi
mov dword [ebp - 0x1c0], esi
mov dword [ebp - 0x1bc], esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x44]
cmp edx, 1
je 0x450a42
mov eax, 0x4070f0
push edx
push eax
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp - 0x1c4]
push eax
call fcn.0045068a
add esp, 0x10
test eax, eax
js 0x450ab1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1d4]
push dword [ebp - 0x1c4]
call fcn.0045032b
sub esp, 0x28
mov byte [ebp - 4], 2
mov eax, esp
mov dword [ebp - 0x1cc], esi
lea ecx, [ebp - 0x1d4]
mov dword [ebp - 0x1c8], esi
mov dword [eax], 0x402630
mov dword [eax + 4], ebx
mov dword [eax + 0x24], eax
lea eax, [ebp - 0x1cc]
push eax
call fcn.00485814
lea ecx, [ebp - 0x1d0]
call fcn.0042bb30
lea ecx, [ebp - 0x1c4]
call fcn.00431b77
call fcn.004678ce
ret
Function at 0x4582b3
Capabilities:
Check if file exists

Disassembly:
push 0x380
mov eax, 0x46f360
call fcn.0046791c
mov edi, ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x2b0]
call fcn.0041da2d
xor ebx, ebx
lea ecx, [ebp - 0x2b0]
push ebx
push 0xf003f
mov dword [ebp - 4], ebx
push dword [0x4a2f58]
push esi
call fcn.00440148
test eax, eax
jns 0x458324
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
je 0x45830f
test eax, eax
jle 0x458451
movzx ebx, ax
or ebx, 0x80070000
lea ecx, [ebp - 0x2b0]
call fcn.004233f9
mov eax, ebx
call fcn.004678b9
ret 8
lea eax, [ebp - 0x354]
mov dword [ebp - 0x358], ebx
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
jmp 0x4583ff
test esi, esi
je 0x4582fe
lea ecx, [ebp - 0x350]
call fcn.0041da2d
push ebx
push 0xf003f
lea eax, [ebp - 0x210]
mov byte [ebp - 4], 1
push eax
push dword [ebp - 0x214]
lea ecx, [ebp - 0x350]
call fcn.00440148
test eax, eax
js 0x45842c
lea ecx, [ebp - 0x38c]
call fcn.0042356a
lea ecx, [ebp - 0x35c]
call fcn.00437ff1
lea eax, [ebp - 0x35c]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x350]
push eax
lea ecx, [ebp - 0x38c]
call fcn.00449ba0
mov esi, dword [ebp - 0x35c]
test eax, eax
js 0x4583c3
lea eax, [ebp - 0x38c]
mov ecx, edi
push eax
push esi
call fcn.0045b3b2
inc dword [ebp - 0x358]
lea ecx, [esi - 0x10]
call fcn.0041db60
lea ecx, [ebp - 0x38c]
call fcn.004232bd
lea ecx, [ebp - 0x350]
mov byte [ebp - 4], bl
call fcn.004233f9
lea eax, [ebp - 0x354]
push eax
lea eax, [ebp - 0x210]
push eax
mov eax, dword [ebp - 0x358]
push eax
lea ecx, [ebp - 0x2b0]
mov dword [ebp - 0x354], pe_nt_image_headers32
call fcn.0043fdb1
mov esi, eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x103
jne 0x45833e
jmp 0x45830f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x458441
movzx ebx, bx
or ebx, 0x80070000
lea ecx, [ebp - 0x350]
call fcn.004233f9
jmp 0x45830f
mov ebx, eax
jmp 0x45830f
Function at 0x45845e
Capabilities:
Check if file exists

Disassembly:
push 0x39c
mov eax, 0x46f3c1
call fcn.0046791c
mov dword [ebp - 0x358], ecx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x2b0]
mov esi, dword [ebp + 0xc]
call fcn.0041da2d
xor ebx, ebx
lea ecx, [ebp - 0x2b0]
push ebx
push 0xf003f
mov dword [ebp - 4], ebx
push dword [esi]
push edi
call fcn.00440148
test eax, eax
jns 0x4584d2
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
je 0x4584bd
test eax, eax
jle 0x458612
movzx ebx, ax
or ebx, 0x80070000
lea ecx, [ebp - 0x2b0]
call fcn.004233f9
mov eax, ebx
call fcn.004678b9
ret 8
lea eax, [ebp - 0x354]
mov edi, ebx
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
jmp 0x4585c0
test esi, esi
je 0x4584ac
lea ecx, [ebp - 0x350]
call fcn.0041da2d
push ebx
push 0xf003f
lea eax, [ebp - 0x210]
mov byte [ebp - 4], 1
push eax
push dword [ebp - 0x214]
lea ecx, [ebp - 0x350]
call fcn.00440148
test eax, eax
js 0x4585ed
lea ecx, [ebp - 0x384]
mov dword [ebp - 0x388], 0x401670
call fcn.00437ff1
lea ecx, [ebp - 0x380]
call fcn.00437ff1
mov byte [ebp - 0x35c], bl
lea ecx, [ebp - 0x3a8]
call fcn.0041e7c0
lea eax, [ebp - 0x3a8]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x350]
push eax
lea ecx, [ebp - 0x388]
call fcn.0041ded0
test eax, eax
js 0x45858c
mov ecx, dword [ebp - 0x358]
lea eax, [ebp - 0x388]
push eax
lea eax, [ebp - 0x3a8]
push eax
call fcn.0041a765
lea ecx, [ebp - 0x3a8]
inc edi
call fcn.0041de3c
lea ecx, [ebp - 0x388]
call fcn.0041e812
lea ecx, [ebp - 0x350]
mov byte [ebp - 4], bl
call fcn.004233f9
lea eax, [ebp - 0x354]
push eax
lea eax, [ebp - 0x210]
push eax
push edi
lea ecx, [ebp - 0x2b0]
mov dword [ebp - 0x354], pe_nt_image_headers32
call fcn.0043fdb1
mov esi, eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x103
jne 0x4584e8
jmp 0x4584bd
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x458602
movzx ebx, bx
or ebx, 0x80070000
lea ecx, [ebp - 0x350]
call fcn.004233f9
jmp 0x4584bd
mov ebx, eax
jmp 0x4584bd
Function at 0x45aad8
Capabilities:
Get disk information

Disassembly:
push 0x228
mov eax, 0x46fdef
call fcn.0046791c
mov ebx, ecx
push dword [ebx + 0x30]
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x1f4]
call fcn.0043340a
xor edi, edi
lea ecx, [ebp - 0x1f0]
mov dword [ebp - 4], edi
push dword [ebx + 0x2c]
call fcn.0043340a
push esi
lea ecx, [ebp - 0x1e8]
mov byte [ebp - 4], 1
call fcn.00437fc6
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1e8]
mov esi, dword [ebp - 0x1e8]
mov eax, dword [esi - 0xc]
dec eax
push eax
call fcn.004381bd
movzx eax, ax
cmp eax, 0x2a
jne 0x45ab52
mov eax, dword [esi - 0xc]
push ecx
dec eax
lea ecx, [ebp - 0x1e8]
push eax
call fcn.00455cb5
jmp 0x45ab6c
cmp eax, 0x5c
je 0x45ab72
cmp eax, 0x2f
je 0x45ab72
push 0x404b74
lea ecx, [ebp - 0x1e8]
call fcn.00441899
mov esi, dword [ebp - 0x1e8]
lea ecx, [ebp - 0x234]
call fcn.0042356a
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 3
mov ecx, dword [ebx + 0x54]
push eax
lea eax, [ebp - 0x1e8]
push eax
call fcn.0045660e
test eax, eax
jne 0x45abaf
cmp dword [ebp - 0x220], eax
jne 0x45ac77
xor edi, edi
inc edi
jmp 0x45ac77
cmp eax, 1
jne 0x45ac77
push ecx
lea ecx, [ebp - 0x1e4]
call fcn.0041b81d
push esi
lea ecx, [ebp - 0x1e4]
mov byte [ebp - 4], 4
call fcn.0043968d
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x1e4]
call fcn.0041b94b
mov eax, dword [ebp - 0x1fc]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 0x204]
lea eax, [ecx + eax*2]
push eax
lea ecx, [ebp - 0x1ec]
call fcn.0042b2d0
push 3
lea eax, [ebp - 0x1f8]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x1ec]
call fcn.00457d6c
push eax
lea ecx, [ebp - 0x1ec]
mov byte [ebp - 4], 6
call fcn.00438106
mov ecx, dword [ebp - 0x1f8]
lea ecx, [ecx - 0x10]
call fcn.0041db60
push 0xa
lea eax, [ebp - 0x24]
push eax
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 0x1ec]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetVolumeInformationW]
mov ecx, dword [ebp - 0x1ec]
neg eax
sbb edi, edi
add ecx, 0xfffffff0
not edi
and edi, 1
call fcn.0041db60
lea ecx, [ebp - 0x1e4]
mov byte [ebp - 4], 3
call fcn.0041b8b5
push esi
lea ecx, [ebp - 0x1ec]
call fcn.0043340a
mov byte [ebp - 4], 7
push dword [ebp - 0x208]
mov edx, dword [ebp - 0x1f0]
mov ecx, dword [ebp - 0x1f4]
push edi
push dword [ebp - 0x1ec]
call fcn.00463a40
push dword [ebp - 0x1ec]
lea edi, [eax + 0x7ff8fffb]
neg edi
sbb edi, edi
and edi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [ebp - 0x234]
call fcn.004232bd
lea ecx, [esi - 0x10]
call fcn.0041db60
push dword [ebp - 0x1f0]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [ebp - 0x1f4]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
call fcn.004678b9
ret 4
Function at 0x45be34
Capabilities:
Parse credit card information

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov esi, ecx
xor al, al
mov ecx, dword [esi + 0x4c]
cmp ecx, 0xffffffff
je 0x45bf97
mov edx, 0x10000000
cmp ecx, 0x7c
je 0x45bf97
cmp ecx, 0x29
jne 0x45be9d
cmp dword [esi + 0x10], 0
jne 0x45bf97
lea edi, [esi + 0x50]
test dword [edi], edx
je 0x45bf9f
cmp ecx, 0x5d
jne 0x45be7e
test dword [edi], edx
je 0x45bf8f
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.0045b817
mov ecx, esi
call fcn.0045dc27
mov ecx, esi
call fcn.0045dc58
mov al, 1
jmp 0x45be3d
lea edi, [esi + 0x50]
cmp ecx, 0x2e
jne 0x45beb1
push 5
lea ecx, [esi + 0x24]
call fcn.0045dbe9
jmp 0x45be8b
cmp ecx, 0x5c
jne 0x45bf01
mov ecx, esi
call fcn.0045dc27
test byte [edi], 0x80
je 0x45bef8
movzx eax, word [esi + 0x48]
mov ecx, eax
cmp eax, 0x62
jne 0x45bee0
push 4
lea ecx, [esi + 0x24]
call fcn.0045dbe9
mov ecx, esi
call fcn.0045dc27
jmp 0x45be99
cmp ecx, 0x42
jne 0x45bef8
push 4
lea ecx, [esi + 0x24]
call fcn.0045dbe9
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x45bed7
mov ecx, esi
call fcn.0045bfad
jmp 0x45be92
cmp ecx, 0x5b
jne 0x45bf24
mov ecx, esi
call fcn.0045dc27
mov ecx, esi
call fcn.0045c53c
push 4
push 0x5d
mov ecx, esi
call fcn.0045d5b2
jmp 0x45be92
cmp ecx, 0x28
jne 0x45bf51
mov ecx, esi
call fcn.0045dc27
mov ecx, esi
call fcn.0045df80
push 5
push 0x29
mov ecx, esi
mov bl, al
call fcn.0045d5b2
test bl, bl
je 0x45be99
jmp 0x45be92
cmp ecx, 0x5e
jne 0x45bf5d
push 2
jmp 0x45becf
cmp ecx, 0x24
jne 0x45bf69
push 3
jmp 0x45becf
cmp ecx, 0x2a
je 0x45bf93
cmp ecx, 0x2b
je 0x45bf93
cmp ecx, 0x3f
je 0x45bf93
cmp ecx, 0x7b
je 0x45bf93
cmp ecx, 0x7d
jne 0x45be71
test dword [edi], edx
je 0x45bf9b
jmp 0x45be7e
push 4
jmp 0x45bfa1
push 0xa
jmp 0x45bfa1
pop edi
pop esi
pop ebx
ret
push 6
jmp 0x45bfa1
push 5
call fcn.0045d563
int3

Function at 0x45f620
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push esi
push eax
mov esi, ecx
xor ecx, ecx
push ecx
push ecx
push ecx
push 0x40a2b0
push esi
mov dword [ebx], ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x45f658
jle 0x45f6d5
movzx eax, ax
or eax, 0x80070000
jmp 0x45f6d5
mov eax, dword [ebp - 4]
test eax, eax
jne 0x45f666
mov eax, 0x8000ffff
jmp 0x45f6d5
push edi
push 0x407ffc
shr eax, 1
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042c568
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x45f692
mov eax, 0x8007000e
jmp 0x45f6d4
lea eax, [ebp - 4]
push eax
push edi
push 0
push 0
push 0x40a2b0
push esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x45f6c5
push edi
call fcn.0042c5d6
pop ecx
test esi, esi
jle 0x45f6c1
movzx esi, si
or esi, 0x80070000
mov eax, esi
jmp 0x45f6d4
mov eax, dword [ebp - 4]
xor ecx, ecx
shr eax, 1
mov word [edi + eax*2], cx
xor eax, eax
mov dword [ebx], edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4628bb
Capabilities:
Get disk information

Disassembly:
push 0x230
mov eax, 0x471126
call fcn.00467994
mov edi, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1ec]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00437fc6
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1ec]
mov eax, dword [ebp - 0x1ec]
mov eax, dword [eax - 0xc]
dec eax
push eax
call fcn.004381bd
movzx eax, ax
cmp eax, 0x2a
jne 0x46291b
mov eax, dword [ebp - 0x1ec]
push ecx
lea ecx, [ebp - 0x1ec]
mov eax, dword [eax - 0xc]
dec eax
push eax
call fcn.00455cb5
jmp 0x462935
cmp eax, 0x5c
je 0x462935
cmp eax, 0x2f
je 0x462935
push 0x404b74
lea ecx, [ebp - 0x1ec]
call fcn.00441899
lea ecx, [ebp - 0x23c]
mov esi, ebx
call fcn.0042356a
lea eax, [ebp - 0x23c]
mov byte [ebp - 4], 2
mov ecx, dword [edi + 0x60]
push eax
lea eax, [ebp - 0x1ec]
push eax
call fcn.0045660e
test eax, eax
jne 0x462974
cmp dword [ebp - 0x228], eax
jne 0x462a3d
xor esi, esi
inc esi
jmp 0x462a3d
cmp eax, 1
jne 0x462a3d
push ecx
lea ecx, [ebp - 0x1e8]
call fcn.0041b81d
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1e8]
push dword [ebp - 0x1ec]
call fcn.0043968d
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x1e8]
call fcn.0041b94b
mov eax, dword [ebp - 0x204]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 0x20c]
lea eax, [ecx + eax*2]
push eax
lea ecx, [ebp - 0x1f0]
call fcn.0042b2d0
push 3
lea eax, [ebp - 0x1f4]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x1f0]
call fcn.00457d6c
push eax
lea ecx, [ebp - 0x1f0]
mov byte [ebp - 4], 5
call fcn.00438106
mov ecx, dword [ebp - 0x1f4]
lea ecx, [ecx - 0x10]
call fcn.0041db60
push 0xa
lea eax, [ebp - 0x28]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x1f0]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetVolumeInformationW]
mov ecx, dword [ebp - 0x1f0]
neg eax
sbb esi, esi
add ecx, 0xfffffff0
inc esi
call fcn.0041db60
lea ecx, [ebp - 0x1e8]
mov byte [ebp - 4], 2
call fcn.0041b8b5
lea ecx, [edi + 4]
call fcn.0042f512
mov edx, eax
lea ecx, [ebp - 0x200]
call fcn.004320c9
lea ecx, [edi + 0x1c]
mov byte [ebp - 4], 6
call fcn.0042f512
mov edx, eax
lea ecx, [ebp - 0x1fc]
call fcn.004320c9
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1f8]
mov edx, dword [ebp - 0x1ec]
call fcn.004320c9
push ebx
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x1fc]
mov ecx, dword [ebp - 0x200]
push esi
push dword [ebp - 0x1f8]
call fcn.00463a40
lea ecx, [ebp - 0x1f8]
lea esi, [eax + 0x7ff8fffb]
neg esi
sbb esi, esi
and esi, eax
call fcn.0043094a
lea ecx, [ebp - 0x1fc]
call fcn.0043094a
lea ecx, [ebp - 0x200]
call fcn.0043094a
lea ecx, [ebp - 0x23c]
call fcn.004232bd
mov ecx, dword [ebp - 0x1ec]
add ecx, 0xfffffff0
call fcn.0041db60
mov eax, esi
jmp 0x462b0b
call fcn.004678ce
ret 4
Function at 0x46396e
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4a13b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x214], eax
xor ebx, ebx
mov dword [ebp - 0x218], 0x104
lea esi, [edi + 4]
cmp dword [edi], ebx
jne 0x4639f3
push ecx
lea eax, [ebp - 0x210]
mov dword [esi], ebx
mov dword [edi], ebx
mov edx, reloc.OLEAUT32.dll_SysReAllocString
push eax
mov ebx, 0x40b648
push ebx
call fcn.00441375
test al, al
je 0x4639ca
lea ebx, [ebp - 0x210]
push edi
push 9
push 0
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jle 0x4639e9
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x463a29
mov eax, dword [ebp - 0x214]
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x218]
push ecx
push eax
push dword [esi]
push dword [edi]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x463a15
xor eax, eax
inc eax
jmp 0x463a29
test eax, eax
je 0x463a25
jle 0x463a29
movzx eax, ax
or eax, 0x80070000
jmp 0x463a29
inc dword [esi]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042bef0
leave
ret 8
Function at 0x466225
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
push edi
mov edi, ecx
cmp dword [ebp + 8], esi
jbe 0x466250
movzx eax, byte [esi + edx]
add eax, dword [edi]
imul ecx, eax, 0x401
mov eax, ecx
shr eax, 6
xor eax, ecx
inc esi
mov dword [edi], eax
cmp esi, dword [ebp + 8]
jb 0x466235
pop edi
pop esi
pop ebp
ret 4

Function at 0x466d69
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a13b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
mov dword [ebp - 0x20], eax
mov esi, ecx
call dword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
test eax, eax
je 0x466dc3
push dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
push esi
push ebx
push edi
push 0x40bedc
push eax
call fcn.00466dda
add esp, 0x18
lea ecx, [ebp - 0x1c]
call fcn.0042f512
push eax
call dword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
lea ecx, [ebp - 0x1c]
call fcn.0042b8df
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042bef0
leave
ret 8
Function at 0x476388
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0x4a13b4]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push esi
push edi
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x20]
mov ebx, ecx
push eax
push ecx
push 0x10
push 0x410cdc
mov edx, 0x404a78
mov byte [ebx], 0
xor esi, esi
call fcn.004416ea
test eax, eax
jne 0x4764d2
cmp dword [esp + 0x1c], esi
je 0x4764d2
lea eax, [esp + 0x28]
push eax
push esi
push esi
push 0x23
push esi
call dword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
js 0x4764d2
push 0x410d10
mov edx, 0x104
lea ecx, [esp + 0x2c]
call fcn.0042f0c9
mov esi, eax
test esi, esi
js 0x4764d2
xor eax, eax
push eax
push eax
push 3
push eax
push eax
push SysReAllocStringLen
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4764a8
push 0
push 0
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileTime]
test eax, eax
jne 0x476467
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x476465
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x47649f
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x20]
add dword [esp + 0x10], 0x2a69c000
push eax
adc ecx, 0xc9
mov dword [esp + 0x18], ecx
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CompareFileTime]
test eax, eax
jns 0x47649f
mov byte [ebx], 1
push edi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x4764d2
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4764bd
movzx esi, si
or esi, 0x80070000
cmp esi, 0x80070002
je 0x4764cd
cmp esi, 0x80070003
jne 0x4764d2
xor esi, esi
mov byte [ebx], 1
mov ecx, dword [esp + 0x234]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042bef0
mov esp, ebp
pop ebp
ret
Function at 0x4770df
Capabilities:
Get common file path

Disassembly:
push 0x424
mov eax, 0x46abb5
call fcn.0046791c
mov dword [ebp - 0x428], edx
mov esi, ecx
mov dword [ebp - 0x424], esi
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x430], eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push esi
push 0
call dword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetFolderPathW]
mov edi, eax
test edi, edi
js 0x4771f2
push 0x40649c
mov edx, 0x104
lea ecx, [ebp - 0x218]
call fcn.0042f0c9
mov ecx, dword [ebp + 4]
mov edi, eax
test edi, edi
jns 0x477159
push edi
push 0x406418
mov edx, 0x260
call fcn.00475b3c
jmp 0x4772af
push 0x4064a4
lea ecx, [ebp - 0x424]
call fcn.0043340a
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [ebp - 0x424], esi
jne 0x477185
mov eax, 0x8007000e
mov edx, 0x26a
mov edi, eax
push eax
jmp 0x4771d4
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x424]
call fcn.004338b7
cmp dword [ebp - 0x424], esi
jne 0x4771ae
mov eax, 0x8007000e
mov edx, 0x271
mov edi, eax
push eax
jmp 0x4771d4
push dword [ebp - 0x430]
mov edx, dword [ebp - 0x428]
mov ecx, dword [ebp - 0x424]
sub esp, 0xc
call fcn.00433dcc
mov edi, eax
test edi, edi
jns 0x4771e1
push edi
mov edx, 0x276
mov ecx, dword [ebp + 4]
push 0x406418
call fcn.00475b3c
push dword [ebp - 0x424]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x4772af
push esi
push 0x410de8
push edi
push 0x406418
push 0x27d
push dword [ebp + 4]
call fcn.0047857a
xor esi, esi
lea eax, [ebp - 0x420]
push 0x208
push esi
push eax
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x428], esi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0x24
lea eax, [ebp - 0x420]
push 0x104
push eax
push esi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x42c]
call fcn.004358fc
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x42c]
push dword [ebx + 8]
push dword [ebx + 4]
push 0x7df
call fcn.0043598b
push dword [ebx + 8]
mov ecx, ebx
mov dword [ebx + 0xc], eax
call fcn.00434f80
mov esi, dword [ebx + 0xc]
push dword [ebp - 0x424]
mov edx, dword [ebx + 8]
push 0x4064b8
sub edx, esi
lea eax, [eax + esi*2]
push edx
push eax
call fcn.0042f13a
add esp, 0xc
mov ecx, ebx
call fcn.0041fb1c
lea ecx, [ebp - 0x42c]
call fcn.0042b397
mov eax, edi
call fcn.004678b9
ret 0x10