joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468f60
Capabilities:
Check if file exists

Disassembly:
cmp word [0x4d1e58], 0
push esi
mov esi, dword [esp + 8]
jne 0x468fcd
test esi, esi
je 0x468fb6
cmp word [esi], 0
je 0x468fb6
push 0x4a06f4
push 0x80
push 0x4d1e58
call fcn.0044a00d
push esi
push 0x80
push 0x4d1e58
call fcn.00447b21
push 0x4a06ec
push 0x80
push 0x4d1e58
call fcn.00447b21
add esp, 0x24
jmp 0x468fcd
push 0x49d738
push 0x80
push 0x4d1e58
call fcn.0044a00d
add esp, 0xc
cmp word [0x4d1f58], 0
jne 0x469021
test esi, esi
je 0x46900a
cmp word [esi], 0
je 0x46900a
push esi
push 0x80
push 0x4d1f58
call fcn.0044a00d
push 0x4a06ec
push 0x80
push 0x4d1f58
call fcn.00447b21
add esp, 0x18
jmp 0x469021
push 0x49ee74
push 0x80
push 0x4d1f58
call fcn.0044a00d
add esp, 0xc
mov eax, dword [0x4d2058]
push ebx
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
push edi
push eax
call ebx
mov esi, dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
jne 0x469049
push 0
push str.ADiagnostic
call esi
mov dword [0x4d2058], eax
cmp dword [0x4d2270], 0
jne 0x469079
mov ecx, dword [0x4d205c]
push ecx
call ebx
test eax, eax
jne 0x469079
push eax
push 0x49ee6c
call esi
test eax, eax
je 0x469079
push 0x78
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [0x4d205c], eax
mov edi, dword [esp + 0x14]
test edi, edi
je 0x4690e5
cmp dword [0x4d2064], 0
jne 0x4690e5
push 0x104
push 0x4d2068
push str.C:DBS.TXT
push str.Filename
push 0x49ee6c
call dword [sym.imp.KERNEL32.dll_GetProfileStringW]
push 0x4d2068
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4690e5
push eax
push 0x80
push 2
push eax
push 3
push 0xc0000000
push 0x4d2068
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4690de
mov dword [0x4d2064], edi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x4d2060]
push edx
call ebx
pop edi
pop ebx
test eax, eax
jne 0x469101
push str.TMonitor
push eax
call esi
mov dword [0x4d2060], eax
pop esi
ret
Function at 0x469110
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4b1120]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4d2058], 0
push ebx
push esi
push edi
jne 0x469154
cmp dword [0x4d205c], 0
jne 0x469154
cmp dword [0x4d2270], 0
jne 0x469154
cmp dword [0x4d2064], 0
jne 0x469154
cmp dword [0x4d2060], 0
je 0x46937d
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
push 0x1000
push 0x4cfe18
call fcn.0044d689
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 0x10
cmp dword [0x4d205c], 0
jne 0x469193
cmp dword [0x4d2270], 0
jne 0x469193
cmp dword [0x4d2064], 0
je 0x4692bd
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 6]
mov eax, 0x66666667
imul ecx
movzx ecx, word [ebp - 8]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
movzx edx, word [ebp - 0xa]
push eax
movzx eax, word [ebp - 0xc]
push ecx
push edx
push eax
push str._02.2u:_02.2u:_02.2u__02.2u
push 0x20
push 0x4d1e18
call fcn.00447c36
push 0x4cfe18
push 0x4d1e18
push 0x4d1e58
push 0x1000
push 0x4cde18
call fcn.00447c36
mov dword [0x4cde10], eax
mov eax, dword [0x4d205c]
add esp, 0x30
test eax, eax
je 0x469211
push 0x4cde18
push 0
push 0x180
push eax
call ebx
cmp dword [0x4d2270], 0
jne 0x469227
cmp dword [0x4d2064], 0
je 0x4692bd
push 0x49ee7c
push 0x1000
push 0x4cde18
call fcn.00447b21
add esp, 0xc
cmp dword [0x4d2270], 0
je 0x469252
push 0x4cde18
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [0x4d2064], 0
je 0x4692bd
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push 0x4d2068
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4692b6
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, 0x4cde18
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x469294
push 0
sub eax, edx
lea ecx, [ebp - 0x24]
push ecx
sar eax, 1
push eax
push 0x4cde18
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x4d2058], 0
jne 0x4692d3
cmp dword [0x4d2060], 0
je 0x46937d
push 0x4cfe18
push 0x4d1f58
push 0x1000
push 0x4cde18
call fcn.00447c36
mov ecx, dword [0x4d2058]
add esp, 0x10
mov dword [0x4cde10], eax
test ecx, ecx
je 0x469323
lea edx, [eax + eax + 2]
lea eax, [ebp - 0x20]
push eax
push 0
push 0x4a
push ecx
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 0x4cde18
call ebx
mov eax, dword [0x4cde10]
cmp dword [0x4d2060], 0
je 0x46937d
inc eax
push 0x4cde18
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
call fcn.0044a220
mov esi, esp
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push 0x4cde18
push 0
push 0
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, dword [0x4d2060]
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0x4a
push edx
mov dword [ebp - 8], esi
call ebx
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447645
mov esp, ebp
pop ebp
ret
Function at 0x4693c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4b1120]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
push edi
push eax
call fcn.004710a0
mov ebx, eax
lea eax, [ebx + 8]
add esp, 4
mov dword [ebp - 0xc], ebx
cmp eax, 0x400
ja 0x469403
call fcn.0044a220
mov eax, esp
test eax, eax
je 0x469419
mov dword [eax], 0xcccc
jmp 0x469416
push eax
call fcn.00448217
add esp, 4
test eax, eax
je 0x469419
mov dword [eax], 0xdddd
add eax, 8
mov edi, eax
test edi, edi
je 0x46952d
mov ecx, dword [esi]
push ecx
push ebx
push 0
push edi
call fcn.00447660
add esp, 0xc
push eax
push esi
call fcn.00471440
add esp, 0xc
test eax, eax
jbe 0x469526
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x469493
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x46948d
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x469457
sub eax, edx
cmp dword [ebx], eax
jbe 0x46948d
mov edx, esi
mov eax, edi
sub edx, edi
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x469470
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x469480
sub eax, edx
mov dword [ebx], eax
jmp 0x469493
mov dword [ebx], 0
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 8]
push edx
push 2
push 2
push 0x40000000
push str.Global.pad
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.00472270
mov esi, eax
mov eax, dword [ebp - 8]
add esp, 0x1c
cmp eax, 0xffffffff
je 0x4694dd
mov ecx, dword [ebp - 0xc]
push 0
lea edx, [ebp - 0xc]
push edx
push ecx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4694dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [edi - 8], 0xdddd
lea eax, [edi - 8]
jne 0x4694fc
push eax
call fcn.004482e1
add esp, 4
cmp dword [ebp + 0x18], 0
je 0x469510
push esi
push str._WriteGlobalPad____WriteGlobalPad_..._____dwError___d
call fcn.00469110
add esp, 8
mov eax, esi
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447645
mov esp, ebp
pop ebp
ret
mov esi, 0xffffffee
jmp 0x4694e7
mov esi, 8
jmp 0x4694fc
Function at 0x469670
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xcc
mov eax, dword [0x4b1120]
xor eax, esp
mov dword [esp + 0xc8], eax
mov eax, dword [esp + 0xd0]
push esi
push edi
mov edi, dword [esp + 0xdc]
push edi
push 2
push 2
push 0x40000000
push str.Info.pad
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00472270
add esp, 0x1c
cmp dword [esp + 8], 0xffffffff
mov esi, eax
je 0x46970b
push 0x44
push 1
lea ecx, [esp + 0x18]
push str._d._02.2d
push ecx
call fcn.00447b9e
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x64]
push str.version_s_r_n
push eax
call fcn.00447b9e
add esp, 0x1c
push 0
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [eax + eax]
push edx
lea eax, [esp + 0x5c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x46970b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x469728
push esi
push str._WriteInfoPad____WriteInfoPad_..._____dwError___d
call fcn.00469110
add esp, 8
mov ecx, dword [esp + 0xd0]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.00447645
add esp, 0xcc
ret
Function at 0x469c10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4b1120]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
push ebx
mov ebx, dword [esp + 0x2c]
push ebp
mov ebp, dword [esp + 0x34]
push esi
push edi
mov edi, dword [esp + 0x34]
lea ecx, [esp + 0x14]
push ecx
push 1
push 0
mov dword [edi], 0
push eax
mov dword [ebx], 0
push closesocket
mov dword [ebp], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x469d45
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
push eax
push eax
push str.NCnxTime
push edx
mov dword [esp + 0x28], 0x10
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
call esi
test eax, eax
jne 0x469cad
lea eax, [esp + 0x18]
push eax
call fcn.0045bb0b
add esp, 4
mov dword [edi], eax
xor eax, eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
push eax
push eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x24]
push str.NCnxModeExpire
push eax
mov dword [esp + 0x28], 0x10
call esi
test eax, eax
jne 0x469cf2
lea ecx, [esp + 0x18]
push ecx
call fcn.0045bb0b
add esp, 4
mov dword [ebx], eax
xor eax, eax
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
push eax
push eax
push str.CnxTime
push edx
mov dword [esp + 0x28], 0x10
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
call esi
mov esi, eax
test esi, esi
jne 0x469d3a
lea eax, [esp + 0x18]
push eax
call fcn.0045bb0b
add esp, 4
mov dword [ebp], eax
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x40], 0
je 0x469d64
mov edx, dword [ebp]
mov eax, dword [ebx]
mov ecx, dword [edi]
push esi
push edx
push eax
push ecx
push str.ReadCnxInfo___NCnxTime___d__NCnxModeExpire___d__CnxTime___d__dwError___d
call fcn.00469110
add esp, 0x14
mov ecx, dword [esp + 0x28]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00447645
add esp, 0x1c
ret
Function at 0x46a7a0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
sub esp, 0xa80
mov eax, dword [0x4b1120]
xor eax, esp
mov dword [esp + 0xa7c], eax
push esi
mov esi, dword [esp + 0xa88]
push edi
lea eax, [esp + 0x5c]
push eax
push esi
call fcn.0046a1e0
mov edi, eax
add esp, 8
test edi, edi
jne 0x46a95d
lea ecx, [esp + 0x5c]
push ecx
push str._APShowMessage____APGetFilePathMessage_..._______s
call fcn.00469110
add esp, 8
lea edx, [esp + 0x5c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46a953
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x46a953
push 0x104
lea ecx, [esp + 0x268]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x46a953
lea edx, [esp + 0x264]
push 0x5c
push edx
mov esi, str.APMessage.exe
call fcn.0044a678
add esp, 8
lea esp, [esp]
movzx ecx, word [esi]
mov word [eax], cx
add esi, 2
add eax, 2
test cx, cx
jne 0x46a840
lea eax, [esp + 0x264]
push eax
push str._APShowMessage____.exe_file_s
call fcn.00469110
mov esi, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
add esp, 8
push 0x104
lea ecx, [esp + 0x678]
push ecx
lea edx, [esp + 0x26c]
push edx
call esi
test eax, eax
jbe 0x46a953
push 0x104
lea eax, [esp + 0x470]
push eax
lea ecx, [esp + 0x64]
push ecx
call esi
test eax, eax
jbe 0x46a953
push 0x44
lea edx, [esp + 0x1c]
push 0
push edx
call fcn.00447660
mov eax, 1
lea ecx, [esp + 0x478]
push ecx
mov word [esp + 0x58], ax
xor eax, eax
lea edx, [esp + 0x684]
push edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x890]
push 0x49d738
push eax
mov dword [esp + 0x34], 0x44
mov dword [esp + 0x60], 1
call fcn.00447b9e
add esp, 0x1c
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [esp + 0x89c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x46a953
push str._APShowMessage____CreateProcess_____TRUE
call fcn.00469110
mov ecx, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 4
push ecx
call esi
mov edx, dword [esp + 0xc]
push edx
call esi
jmp 0x46a96c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x46a96c
push edi
push esi
push str._APShowMessage____APGetFilePathMessage__s_...__returns__d
call fcn.00469110
add esp, 0xc
push edi
push str._APShowMessage____returns__d
call fcn.00469110
mov ecx, dword [esp + 0xa8c]
add esp, 8
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.00447645
add esp, 0xa80
ret
Function at 0x46a9a0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4b1120]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
push edi
mov edi, dword [esp + 0x218]
lea eax, [esp + 8]
push eax
push edi
call fcn.0046a1e0
mov esi, eax
add esp, 8
test esi, esi
jne 0x46aa3e
lea ecx, [esp + 8]
push ecx
push str._APDeleteFileMessage____APGetFilePathMessage_..._______s
call fcn.00469110
add esp, 8
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46aa2d
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test al, 1
je 0x46aa18
and eax, 0xfffffffe
push eax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x46aa18
call edi
mov esi, eax
test esi, esi
jne 0x46aa4d
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x46aa4d
call edi
mov esi, eax
jmp 0x46aa4d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 2
jne 0x46aa4d
xor esi, esi
jmp 0x46aa4d
push esi
push edi
push str._APDeleteFileMessage____APGetFilePathMessage__s_...__returns__d
call fcn.00469110
add esp, 0xc
push esi
push str._APDeleteFileMessage____returns__d
call fcn.00469110
mov ecx, dword [esp + 0x218]
add esp, 8
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.00447645
add esp, 0x20c
ret
Function at 0x46c7a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x4b1120]
xor eax, esp
mov dword [esp + 0x210], eax
mov eax, dword [esp + 0x224]
push ebx
mov ebx, dword [esp + 0x21c]
push ebp
push esi
mov esi, dword [esp + 0x234]
xor ebp, ebp
push edi
mov edi, dword [esp + 0x22c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], esi
cmp dword [esp + 0x23c], ebp
je 0x46c7f5
push ebx
push str._ReadOldAPKeyName__d
call fcn.00469110
add esp, 8
mov dword [esp + 0x10], ebp
cmp edi, ebp
je 0x46c8ff
cmp esi, ebp
je 0x46c8ff
mov ecx, dword [esp + 0x230]
push ecx
push ebp
push edi
call fcn.00447660
lea edx, [esp + 0x2c]
add esp, 0xc
mov eax, ebx
sub edx, ebx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bp
jne 0x46c823
lea eax, [esp + 0x20]
add eax, 0xfffffffe
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax + 2]
add eax, 2
cmp cx, bp
jne 0x46c840
mov ecx, dword [0x4a3bf0]
mov dword [eax], ecx
mov ecx, dword [0x4a3bf4]
mov dword [eax + 4], ecx
lea eax, [esp + 0x14]
push eax
push 1
push ebp
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x46c904
cmp dword [esp + 0x23c], ebp
je 0x46c896
lea ecx, [esp + 0x20]
push ecx
push str._ReadOldAPKeyName____Clef_de_r
call fcn.00469110
add esp, 8
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x230]
push edx
push edi
push 0
push 0
push str.Data
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x14]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x46c904
cmp dword [esp + 0x230], ebp
jbe 0x46c904
mov esi, dword [esp + 0x23c]
test esi, esi
je 0x46c8e6
push edi
push str._ReadOldAPKeyName____fExists__TRUE__lpszAPKeyName___s
call fcn.00469110
add esp, 8
push esi
lea edx, [esp + 0x14]
push edx
push edi
push ebx
mov ebp, 1
call fcn.0046c1a0
add esp, 0x10
mov esi, eax
jmp 0x46c904
mov esi, 0xfffffffa
mov eax, dword [esp + 0x18]
test eax, eax
je 0x46c90e
mov dword [eax], esi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x46c91c
mov ecx, dword [esp + 0x10]
mov dword [eax], ecx
cmp dword [esp + 0x23c], 0
je 0x46c93a
mov edx, dword [esp + 0x10]
push edx
push esi
push ebp
push str._ReadOldAPKeyName__fin___fExists___d__dwError___ld__dwErrAP___ld
call fcn.00469110
add esp, 0x10
mov ecx, dword [esp + 0x220]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.00447645
add esp, 0x214
ret
Function at 0x46dba0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4b1120]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
test ebx, ebx
je 0x46dcab
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46dbc3
sub eax, edx
sar eax, 1
lea edi, [eax + 1]
lea eax, [edi + edi + 8]
mov dword [ebp - 8], edi
cmp eax, 0x400
ja 0x46dbfd
call fcn.0044a220
mov esi, esp
test esi, esi
je 0x46dc92
mov dword [esi], 0xcccc
add esi, 8
jmp 0x46dc15
push eax
call fcn.00448217
add esp, 4
test eax, eax
je 0x46dc13
mov dword [eax], 0xdddd
add eax, 8
mov esi, eax
test esi, esi
je 0x46dc92
push ebx
push edi
push esi
call fcn.0044a00d
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax + 2]
mov eax, ebx
call fcn.0044a220
mov edi, esp
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push esi
push 0
push 0
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
push edi
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp dword [esi - 8], 0xdddd
mov edi, eax
lea eax, [esi - 8]
jne 0x46dc7c
push eax
call fcn.004482e1
add esp, 4
mov eax, edi
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447645
mov esp, ebp
pop ebp
ret
mov eax, 8
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447645
mov esp, ebp
pop ebp
ret
mov eax, 0x57
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00447645
mov esp, ebp
pop ebp
ret

Function at 0x46dd80
Capabilities:
Read file on windows

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
xor ebp, ebp
xor edi, edi
test esi, esi
jne 0x46dd94
mov esi, 0x1000
push ebx
mov ebx, dword [esp + 0x18]
lea esp, [esp]
test edi, edi
jne 0x46ddaf
push esi
call fcn.00448217
add esp, 4
jmp 0x46ddbe
mov ecx, dword [ebx]
lea eax, [esi + edi]
push eax
push ecx
call fcn.0044d2b8
add esp, 8
mov dword [ebx], eax
test eax, eax
je 0x46ddfa
push 0
lea edx, [esp + 0x24]
push edx
push esi
push esi
add eax, edi
push 0
push eax
call fcn.00447660
add esp, 0xc
push eax
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x46ddf2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov eax, dword [esp + 0x20]
add edi, eax
jmp 0x46de03
xor eax, eax
mov dword [esp + 0x20], eax
lea ebp, [eax + 8]
cmp eax, esi
je 0x46dda0
mov eax, dword [esp + 0x1c]
pop ebx
test eax, eax
je 0x46de12
mov dword [eax], edi
pop edi
pop esi
mov eax, ebp
pop ebp
ret

Function at 0x46de20
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
push edi
push 0
push 0
push esi
push 0
call ebx
cmp eax, 1
jne 0x46de50
push edi
push 0
push 0
or esi, 0x8000
push esi
push 0
call ebx
pop edi
pop esi
pop ebx
ret
Function at 0x46de60
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x414
mov eax, dword [0x4b1120]
xor eax, esp
mov dword [esp + 0x410], eax
push ebp
mov ebp, dword [esp + 0x41c]
xor ecx, ecx
test ebp, ebp
je 0x46dffa
movzx eax, word [ebp]
test ax, ax
je 0x46dffa
cmp ax, 0x5c
jne 0x46deaf
lea eax, [ebp + 2]
mov edx, ebp
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x46dea0
push 0x5c
push ebp
call fcn.0044a678
add esp, 8
lea edx, [esp + 4]
test eax, eax
je 0x46dee1
add eax, 2
sub edx, eax
jmp 0x46ded0
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x46ded0
jmp 0x46def4
mov eax, ebp
sub edx, ebp
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x46dee5
push esi
push ebp
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x46df86
mov eax, dword [esp + 0x424]
lea edx, [esp + 0x210]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x46df14
lea eax, [esp + 0x210]
push 0x5c
push eax
call fcn.0044a678
add esp, 8
test eax, eax
je 0x46df86
xor ecx, ecx
mov word [eax + 2], cx
mov eax, ebp
mov edx, ebp
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46df43
push ebx
push edi
lea edi, [esp + 0x218]
sub eax, edx
add edi, 0xfffffffe
lea ebx, [edi + 2]
nop
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x46df60
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.SHLWAPI.dll_PathCanonicalizeW]
pop edi
pop ebx
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push ebp
call esi
test eax, eax
jne 0x46dfbf
lea eax, [esp + 8]
mov edx, ebp
mov ecx, eax
sub edx, ecx
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x46dfa0
push 0
push ebp
call dword [sym.imp.SHLWAPI.dll_PathFindOnPathW]
push ebp
call esi
test eax, eax
je 0x46dfdb
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.00447645
add esp, 0x414
ret
xor edx, edx
pop esi
mov word [ebp], dx
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.00447645
add esp, 0x414
ret
mov eax, ecx
mov ecx, dword [esp + 0x414]
pop ebp
xor ecx, esp
call fcn.00447645
add esp, 0x414
ret