joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ac00
Capabilities:
Change the wallpaper
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x9c
mov eax, dword [0x69e3d4]
xor eax, esp
mov dword [esp + 0x98], eax
push ebx
push esi
push edi
mov ebx, ecx
push 1
mov dword [esp + 0x18], ebx
call fcn.00567a3f
test eax, eax
je 0x44ae0f
call fcn.0056efb5
test eax, eax
je 0x44ac46
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x74]
call eax
jmp 0x44ac48
xor eax, eax
push eax
push 0x6484d8
call fcn.0056ef6f
mov esi, eax
add esp, 8
test esi, esi
je 0x44ae08
xor edi, edi
call fcn.00426bc0
test eax, eax
je 0x44ae08
call fcn.00426bc0
mov ecx, eax
call fcn.0041e050
test eax, eax
je 0x44ae08
call fcn.00426bc0
mov ecx, eax
call fcn.0041e050
mov dword [esp + 0x10], eax
lea eax, [esp + 0x50]
call fcn.00437830
mov ecx, 0xe
mov esi, 0x6bd744
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov esi, eax
mov ecx, 0xe
mov edi, 0x6bd744
rep movsd dword es:[edi], dword [esi]
mov ebx, 0x6bd744
mov dword [0x6bd760], 6
call fcn.00437870
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 0x74]
mov ecx, dword [esp + 0x10]
push 0
lea ebx, [edi + 0x74]
push 0
push eax
push ecx
call fcn.00436dc0
add esp, 0x10
test eax, eax
je 0x44ade6
lea edx, [esp + 0x10]
push edx
push 0x20006
push 0
push str.Control_PanelDesktop
push 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44adbd
mov eax, dword [edi + 0x78]
push eax
lea ecx, [esp + 0x54]
push 0x641f58
push ecx
call fcn.005a5a2e
lea eax, [esp + 0x5c]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x44ad33
mov esi, dword [sym.imp.advapi32.dll_RegSetValueExA]
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x54]
push edx
push 1
push 0
push str.WallpaperStyle
push eax
call esi
xor ecx, ecx
cmp dword [edi + 0x78], 1
lea edx, [esp + 0x50]
sete cl
push ecx
push 0x641f58
push edx
call fcn.005a5a2e
lea eax, [esp + 0x5c]
add esp, 0xc
lea ecx, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x44ad80
sub eax, ecx
mov ecx, dword [esp + 0x10]
push eax
lea eax, [esp + 0x54]
push eax
push 1
push 0
push str.TileWallpaper
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [ebx]
push 3
push eax
push 0
push 0x14
call dword [sym.imp.user32.dll_SystemParametersInfoA]
jmp 0x44adcb
push 0xffffffffffffffff
push 0
push 0x94
call fcn.005723b2
mov ecx, dword [edi + 0x78]
mov dword [0x6bccf0], ecx
push ebx
mov ecx, 0x6bd844
call fcn.004074e0
call fcn.0044abc0
jmp 0x44adf4
push 0xffffffffffffffff
push 0
push 0x93
call fcn.005723b2
mov ebx, dword [esp + 0x14]
mov ecx, 0xe
lea esi, [esp + 0x18]
mov edi, 0x6bd744
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
call fcn.0056bea4
mov ecx, dword [esp + 0xa4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005a58d9
mov esp, ebp
pop ebp
ret
Function at 0x452100
Capabilities:
Check os version

Disassembly:
push ebx
push edi
call fcn.004ec3b0
xor edi, edi
mov ebx, 1
push esi
mov dword [esi + 0xf4], edi
mov dword [esi + 0xf8], edi
mov dword [esi + 0xfc], 0x140
mov dword [esi + 0x100], 0xf0
mov dword [esi + 0x110], edi
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], edi
mov dword [esi + 0xc0], 0x1f4
mov dword [esi + 0xc4], edi
mov dword [esi + 0xbc], 0x14
mov dword [esi + 0xd0], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xb8], edi
mov dword [esi + 0xb4], edi
mov dword [esi + 0xac], 0xffffff
mov dword [esi + 0xb0], edi
mov dword [esi + 0x10c], edi
mov dword [esi + 0xf0], edi
mov dword [esi + 0xd4], ebx
mov dword [esi + 0xd8], ebx
mov dword [esi + 0xdc], ebx
mov dword [esi + 0x104], edi
mov dword [esi + 0xe0], edi
mov dword [esi + 0x118], edi
mov dword [esi + 0x114], edi
mov dword [esi + 0xe4], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xe8], edi
mov dword [esi + 0xec], edi
mov dword [esi], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
mov eax, dword [esi + 4]
cmp eax, 4
mov dword [esi + 0x108], edi
jbe 0x452207
mov dword [esi + 0x108], 0x40000000
cmp eax, 5
ja 0x45221e
jne 0x452213
cmp dword [esi + 8], ebx
jae 0x45221e
mov dword [esi + 0x94], edi
pop edi
mov eax, esi
pop ebx
ret
pop edi
mov dword [esi + 0x94], ebx
mov eax, esi
pop ebx
ret
Function at 0x454250
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
sub esp, 0x104
mov eax, dword [0x69e3d4]
xor eax, esp
mov dword [esp + 0x100], eax
push ebx
push ebp
push esi
push edi
push 0
call dword [sym.imp.user32.dll_GetTopWindow]
mov ebx, dword [sym.imp.user32.dll_GetWindow]
mov ebp, eax
xor esi, esi
lea ebx, [ebx]
cmp esi, ebp
je 0x454396
test ebp, ebp
je 0x454396
push ebp
call dword [sym.imp.user32.dll_IsWindowVisible]
test eax, eax
jne 0x4542ab
push 2
push ebp
call ebx
mov ebp, eax
test ebp, ebp
jne 0x454290
jmp 0x454396
test ebp, ebp
je 0x454396
push 0xff
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.user32.dll_GetClassNameA]
mov edi, str.tooltips_class32
lea esi, [esp + 0x10]
mov ecx, 0x11
xor edx, edx
mov byte [esp + 0x10f], 0
repe cmpsb byte [esi], byte es:[edi]
je 0x45437c
mov edi, str.OfficeTooltip
lea esi, [esp + 0x10]
mov ecx, 0xe
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x45437c
mov edi, str.FlyHelp
lea esi, [esp + 0x10]
mov ecx, 8
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x45437c
mov edi, str.SysShadow
lea esi, [esp + 0x10]
mov ecx, 0xa
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x45437c
mov edi, str.MozillaWindowClass
lea esi, [esp + 0x10]
mov ecx, 0x13
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x45434c
mov edi, str.32774
lea esi, [esp + 0x10]
mov ecx, 7
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x454385
push 0xff
lea ecx, [esp + 0x14]
push ecx
push ebp
call dword [sym.imp.user32.dll_GetWindowTextA]
cmp byte [esp + 0x10], 0
jne 0x454385
mov esi, dword [sym.imp.user32.dll_GetWindowLongA]
push 0xffffffffffffffec
push ebp
call esi
test al, 8
je 0x454385
push 0xfffffffffffffff0
push ebp
call esi
test eax, eax
jns 0x454385
push 0
push ebp
call dword [sym.imp.user32.dll_ShowWindow]
push 2
push ebp
mov esi, ebp
call ebx
mov ebp, eax
test ebp, ebp
jne 0x454280
mov ecx, dword [esp + 0x110]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005a58d9
add esp, 0x104
ret
Function at 0x454f10
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, eax
mov eax, dword [ebx + 0x10c]
test eax, eax
je 0x454f26
push eax
call fcn.005a8a7b
add esp, 4
test esi, esi
mov dword [ebx + 0x10c], 0
je 0x454f94
push 0x649a48
push esi
call fcn.005a6c42
mov esi, eax
add esp, 8
test esi, esi
je 0x454f9b
push edi
push 2
push 0
push esi
call fcn.005a931a
push esi
call fcn.005a9537
push 0
push 0
push esi
mov edi, eax
call fcn.005a931a
lea eax, [edi + 8]
push 1
push eax
call fcn.005a997a
add esp, 0x24
test eax, eax
mov dword [ebx + 0x10c], eax
je 0x454f8a
push esi
push 1
push edi
push eax
call fcn.005a9841
add esp, 0x10
push esi
call fcn.005a6e16
add esp, 4
pop edi
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x454fa0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov eax, dword [ebp + 0x10c]
test eax, eax
push esi
push edi
je 0x454fbb
push eax
call fcn.005a8a7b
add esp, 4
mov dword [ebp + 0x10c], 0
call fcn.005702dd
mov esi, dword [eax + 0xc]
push str.WAVE
push 0x7d3
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x455032
push edi
push esi
call dword [sym.imp.kernel32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.kernel32.dll_LoadResource]
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x455032
lea eax, [ebx + 8]
push 1
push eax
call fcn.005a997a
add esp, 8
test eax, eax
mov dword [ebp + 0x10c], eax
je 0x455026
push ebx
push esi
push eax
call fcn.005a8cf0
add esp, 0xc
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
Function at 0x457f70
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x10c
mov eax, dword [0x69e3d4]
xor eax, esp
mov dword [esp + 0x108], eax
lea eax, [esi - 0x60]
cmp eax, 9
push edi
mov edi, dword [sym.imp.user32.dll_GetAsyncKeyState]
ja 0x457f9c
push 0x12
call edi
test ax, ax
jns 0x457fad
cmp dword [0x6bce4c], 0
je 0x458018
lea ecx, [esi - 0x41]
cmp ecx, 0x19
ja 0x458018
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.user32.dll_GetKeyboardState]
call fcn.0056efb5
mov eax, dword [eax + 0x30]
push eax
call dword [sym.imp.user32.dll_GetKeyboardLayout]
push eax
push 1
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push esi
call dword [sym.imp.user32.dll_MapVirtualKeyA]
push eax
push esi
call dword [sym.imp.user32.dll_ToAsciiEx]
mov al, byte [esp + 8]
lea ecx, [esp + 4]
push ecx
mov byte [esp + 8], al
mov byte [esp + 9], 0
call dword [sym.imp.user32.dll_CharUpperA]
movsx eax, byte [esp + 4]
pop edi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.005a58d9
add esp, 0x10c
ret
push 0x12
call edi
test ax, ax
jns 0x458039
mov eax, esi
pop edi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.005a58d9
add esp, 0x10c
ret
push esi
call fcn.005aa2b3
mov ecx, dword [esp + 0x110]
add esp, 4
pop edi
xor ecx, esp
call fcn.005a58d9
add esp, 0x10c
ret
Function at 0x4580e0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x615fe8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x69e3d4]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x69e3d4]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov esi, ecx
mov ebp, dword [esp + 0x64]
push 0x33
lea eax, [esp + 0x20]
push 0
push eax
call fcn.005ab440
add esp, 0xc
push 0
call dword [sym.imp.user32.dll_GetKeyboardLayout]
push eax
push 0
push esi
call dword [sym.imp.user32.dll_MapVirtualKeyExA]
shl eax, 0x10
add esi, 0xffffffdf
or eax, 1
cmp esi, 0xe
ja 0x45814e
or eax, 0x1000000
push 0x32
lea ecx, [esp + 0x20]
push ecx
push eax
call dword [sym.imp.user32.dll_GetKeyNameTextA]
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x18]
call fcn.00404eb0
lea edi, [esp + 0x14]
mov dword [esp + 0x5c], 0
call fcn.0041c7e0
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0xc]
xor esi, esi
test ecx, ecx
jle 0x4581be
mov edi, dword [sym.imp.user32.dll_IsCharLowerA]
test esi, esi
jl 0x458266
cmp esi, ecx
jg 0x458266
mov bl, byte [esi + eax]
mov byte [esp + 0x18], bl
mov eax, dword [esp + 0x18]
push eax
call edi
test eax, eax
jne 0x458213
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0xc]
add esi, 1
cmp esi, ecx
jl 0x45818e
mov ecx, dword [eax - 0xc]
push ecx
push eax
mov ecx, ebp
call fcn.00407400
mov dword [esp + 0x5c], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4581f2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.005a58d9
add esp, 0x4c
ret 4
movsx ecx, bl
push ecx
call fcn.005aa2b3
mov bl, al
mov eax, dword [esp + 0x18]
mov edi, dword [eax - 0xc]
add esp, 4
cmp esi, edi
jge 0x458266
cmp dword [eax - 4], 1
jle 0x458242
mov edx, edi
push edx
lea ecx, [esp + 0x18]
call fcn.004013c0
mov eax, dword [esp + 0x14]
test edi, edi
mov byte [esi + eax], bl
jl 0x458266
mov eax, dword [esp + 0x14]
cmp edi, dword [eax - 8]
jg 0x458266
mov dword [eax - 0xc], edi
mov eax, dword [esp + 0x14]
mov byte [edi + eax], 0
mov eax, dword [esp + 0x14]
jmp 0x4581be
push 0x80070057
call fcn.004012f0
int3
Function at 0x459970
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x1c], 0
je 0x45997f
xor eax, eax
pop esi
ret 8
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 4
lea ecx, [esp + 0x10]
push ecx
push 4
push 0
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0x10]
push edx
push eax
call dword [sym.imp.advapi32.dll_RegSetValueExA]
xor ecx, ecx
test eax, eax
sete cl
mov dword [esi + 4], eax
mov dword [esi + 0xc], 4
mov dword [esi + 8], 4
pop esi
mov eax, ecx
ret 8

Function at 0x4599f0
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x1c], 0
je 0x4599ff
xor eax, eax
pop esi
ret 8
push edi
mov edi, dword [esp + 0x10]
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x459a10
mov ecx, dword [esi + 0x10]
sub eax, edx
add eax, 1
push eax
mov eax, dword [esp + 0x10]
push edi
push 1
push 0
push eax
push ecx
call dword [sym.imp.advapi32.dll_RegSetValueExA]
mov ecx, edi
mov dword [esi + 4], eax
lea edi, [ecx + 1]
jmp 0x459a40
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x459a40
sub ecx, edi
xor edx, edx
add ecx, 1
test eax, eax
sete dl
pop edi
mov dword [esi + 0xc], ecx
mov dword [esi + 8], 1
pop esi
mov eax, edx
ret 8
Function at 0x459f90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x60cf4b
mov eax, dword fs:[0]
push eax
sub esp, 0x90
push ebx
push esi
push edi
mov eax, dword [0x69e3d4]
xor eax, esp
push eax
lea eax, [esp + 0xa0]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x1c], 0
jne 0x45a145
lea ecx, [esp + 0x18]
call fcn.0057e362
push 1
push 0x14
mov dword [esp + 0xb0], 0
call fcn.005a997a
add esp, 8
push 0xffffffffffffffff
push 5
lea ecx, [esp + 0x20]
mov ebx, eax
call fcn.00593c01
cmp dword [esp + 0x20], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov ecx, dword [ecx]
jg 0x45a010
call fcn.0056c8bd
mov edx, dword [esp + 0x1c]
mov dword [edx], ecx
cmp dword [esp + 0x20], 1
mov eax, dword [eax]
mov eax, dword [eax + 4]
jg 0x45a027
call fcn.0056c8bd
mov ecx, dword [esp + 0x1c]
push 0x10
push 0x14
mov dword [ecx + 4], eax
push ebx
lea ecx, [esp + 0x38]
call fcn.0058d3a5
push 0
push 0x1000
push 0
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x64]
mov byte [esp + 0xb8], 1
call fcn.00585cdd
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0xac], 2
call fcn.0057e389
lea ecx, [esp + 0x54]
call fcn.00585b38
lea ecx, [esp + 0x2c]
call fcn.0058d48c
mov edi, eax
push edi
lea ecx, [esp + 0x30]
call fcn.0058d401
mov ecx, dword [ebp + 8]
mov edx, dword [esi + 0x10]
push eax
push 3
push 0
push ecx
push edx
call dword [sym.imp.advapi32.dll_RegSetValueExA]
test ebx, ebx
mov dword [esp + 0x14], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], edi
mov dword [esi + 8], 2
je 0x45a0c4
push ebx
call fcn.005a8a7b
mov eax, dword [esp + 0x18]
add esp, 4
test eax, eax
mov byte [esp + 0xa8], 1
lea ecx, [esp + 0x54]
jne 0x45a11b
call fcn.00585c9f
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa8], 0
call fcn.0058d719
lea ecx, [esp + 0x18]
mov dword [esp + 0xa8], 0xffffffff
call fcn.0057e379
mov eax, 1
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.00585c9f
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa8], 0
call fcn.0058d719
lea ecx, [esp + 0x18]
mov dword [esp + 0xa8], 0xffffffff
call fcn.0057e379
xor eax, eax
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x45a160
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x1c], 0
je 0x45a16f
xor eax, eax
pop esi
ret 0xc
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esi + 0x10]
push edi
mov edi, dword [esp + 0x14]
push edi
push eax
push 3
push 0
push ecx
push edx
call dword [sym.imp.advapi32.dll_RegSetValueExA]
xor ecx, ecx
test eax, eax
sete cl
mov dword [esi + 0xc], edi
mov dword [esi + 4], eax
pop edi
mov dword [esi + 8], 3
pop esi
mov eax, ecx
ret 0xc
Function at 0x45a1b3
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
mov esi, ecx
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esi + 0x10]
lea edx, [esp + 0x18]
push edx
push 0
push eax
push ecx
mov dword [esp + 0x1c], 4
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 4]
mov dword [esi + 4], eax
mov dword [esi + 8], edx
mov dword [esi + 0xc], ecx
pop esi
jne 0x45a209
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x10]
mov dword [edx], eax
mov eax, 1
add esp, 8
ret 8
xor eax, eax
add esp, 8
ret 8

Function at 0x45a220
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
push ebp
push esi
push edi
xor ebp, ebp
lea eax, [esp + 0xc]
push eax
push ebp
mov edi, ecx
mov eax, dword [edi + 0x10]
lea ecx, [esp + 0x18]
push ecx
push ebp
push edx
push eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], ebp
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov esi, eax
cmp esi, ebp
jne 0x45a2bf
mov eax, dword [esp + 0xc]
cmp eax, ebp
jbe 0x45a2bf
mov ebp, eax
add eax, 1
push ebx
push eax
call fcn.005655d6
add esp, 4
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [edi + 0x10]
mov ebx, eax
mov eax, dword [esp + 0x20]
push ebx
lea edx, [esp + 0x1c]
push edx
push 0
push eax
push ecx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
jne 0x45a2aa
cmp dword [esp + 0x10], eax
jbe 0x45a2aa
mov ecx, dword [esp + 0x20]
push ebx
call fcn.004015c0
push ebx
call fcn.005655db
add esp, 4
pop ebx
jmp 0x45a2c8
mov ecx, dword [esp + 0x20]
call fcn.00401560
push ebx
call fcn.005655db
add esp, 4
pop ebx
jmp 0x45a2c8
mov ecx, dword [esp + 0x1c]
call fcn.00401560
mov edx, dword [esp + 0x10]
mov dword [edi + 4], esi
mov dword [edi + 0xc], ebp
mov dword [edi + 8], edx
xor eax, eax
pop edi
test esi, esi
pop esi
sete al
pop ebp
add esp, 8
ret 8
Function at 0x45a6a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x60e0ab
mov eax, dword fs:[0]
push eax
sub esp, 0x90
push ebx
push esi
push edi
mov eax, dword [0x69e3d4]
xor eax, esp
push eax
lea eax, [esp + 0xa0]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0x14]
call fcn.0057e362
push 1
mov dword [esp + 0xac], 0
push 0x14
mov dword [esp + 0x18], 0x14
call fcn.005a997a
mov edx, dword [ebp + 8]
add esp, 8
mov esi, eax
lea eax, [esp + 0x10]
push eax
mov eax, dword [edi + 0x10]
push esi
lea ecx, [esp + 0x30]
push ecx
push 0
push edx
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov ebx, eax
test ebx, ebx
jne 0x45a7f5
cmp dword [esp + 0x28], 3
jne 0x45a7f5
mov ecx, dword [esp + 0x10]
push eax
push ecx
push esi
lea ecx, [esp + 0x38]
call fcn.0058d3a5
push ebx
push 0x1000
push 1
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x64]
mov byte [esp + 0xb8], 1
call fcn.00585cdd
push 0xffffffffffffffff
mov byte [esp + 0xac], 2
push ebx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x60], ebx
call fcn.00593c01
push 0xffffffffffffffff
push 5
lea ecx, [esp + 0x1c]
call fcn.00593c01
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x18]
call fcn.0057e389
lea ecx, [esp + 0x54]
call fcn.00585b38
lea ecx, [esp + 0x2c]
call fcn.0058d401
cmp dword [esp + 0x1c], ebx
mov esi, eax
jg 0x45a7ae
call fcn.0056c8bd
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [edx], eax
cmp dword [esp + 0x1c], 1
jg 0x45a7c7
call fcn.0056c8bd
mov eax, dword [esp + 0x18]
mov ecx, dword [ecx]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
lea ecx, [esp + 0x54]
mov byte [esp + 0xa8], 1
call fcn.00585c9f
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa8], 0
call fcn.0058d719
test esi, esi
mov dword [edi + 4], ebx
mov dword [edi + 8], 2
mov dword [edi + 0xc], 8
je 0x45a813
push esi
call fcn.005a8a7b
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0xa8], 0xffffffff
call fcn.0057e379
test ebx, ebx
jne 0x45a846
lea eax, [ebx + 1]
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x45ab74
Capabilities:
Delete registry value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov ecx, dword [esi + 0x10]
push eax
push ecx
call dword [sym.imp.advapi32.dll_RegDeleteValueA]
xor ecx, ecx
xor edx, edx
cmp eax, ecx
sete dl
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
pop esi
mov eax, edx
ret 4
Function at 0x45c250
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x619358
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x69e3d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], ebx
call fcn.005776d4
mov byte [ebp - 4], 1
mov edi, dword [sym.imp.user32.dll_GetSystemMetrics]
push 0x31
call edi
push 0x32
mov esi, eax
call edi
lea ecx, [ebp - 0x2c]
mov edi, eax
call fcn.00576f1a
push ebx
mov byte [ebp - 4], 2
call dword [sym.imp.gdi32.dll_CreateCompatibleDC]
push eax
lea ecx, [ebp - 0x2c]
call fcn.005775b2
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], vtable.CBitmap.0
push edi
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x4c]
push esi
push eax
call dword [sym.imp.gdi32.dll_CreateCompatibleBitmap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00577879
cmp eax, ebx
jne 0x45c330
push 0xffffffffffffffff
push ebx
push 0x3e8a
call fcn.005723b2
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], vtable.CBitmap.0
call fcn.00424fa0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.0057762c
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0
call fcn.00577728
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x28]
push ecx
push edx
call fcn.005778fe
mov edx, dword [ebp - 0x28]
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov eax, dword [0x6bd8e0]
push eax
lea ecx, [ebp - 0x3c]
push ecx
push edx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], edi
call dword [sym.imp.user32.dll_FillRect]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
push ecx
lea eax, [ebp - 0x3c]
call fcn.0045c1d0
test ebx, ebx
je 0x45c378
mov ebx, dword [ebx + 4]
mov edx, dword [ebp - 0x28]
push ebx
push edx
call fcn.005778fe
call fcn.0056efb5
test eax, eax
je 0x45c396
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x74]
call eax
jmp 0x45c398
xor eax, eax
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.user32.dll_OpenClipboard]
test eax, eax
jne 0x45c3ae
push 0xffffffffffffffff
push eax
jmp 0x45c2e5
call dword [sym.imp.user32.dll_EmptyClipboard]
test eax, eax
jne 0x45c3d0
push 0xffffffffffffffff
push eax
push 0x3e8a
call fcn.005723b2
call dword [sym.imp.user32.dll_CloseClipboard]
jmp 0x45c2ef
lea ecx, [ebp - 0x1c]
call fcn.005778a2
push eax
push 2
call dword [sym.imp.user32.dll_SetClipboardData]
test eax, eax
jne 0x45c3f2
push 0xffffffffffffffff
push eax
push 0x3e8a
call fcn.005723b2
call dword [sym.imp.user32.dll_CloseClipboard]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], vtable.CBitmap.0
call fcn.00424fa0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.0057762c
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0
call fcn.00577728
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4