joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4618c4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00407b44
mov eax, dword [ebp - 8]
call fcn.00407b44
xor eax, eax
push ebp
push 0x4619d7
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor ebx, ebx
mov eax, dword [0x4e1620]
cmp byte [eax], 0
je 0x46192a
call fcn.0040bd88
cmp byte [eax + 0x15], 0
je 0x461917
mov ebx, pe_nt_image_headers32
jmp 0x46192a
call fcn.0040bd88
cmp byte [eax + 0x14], 0
je 0x46192a
mov ebx, 0x200
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
or ebx, 0x20006
push ebx
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004088a8
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
push ebx
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x4619bc
cmp dword [ebp - 8], 0
jne 0x461985
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
test ebx, ebx
sete byte [ebp - 9]
jmp 0x4619ad
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004088a8
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
test ebx, ebx
sete byte [ebp - 9]
push ebx
call sub.kernel32.dll_SetLastError
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4619de
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407ac0
ret
Function at 0x4619ec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00407b44
mov eax, dword [ebp - 8]
call fcn.00407b44
xor eax, eax
push ebp
push 0x461b2c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [edi], eax
xor ebx, ebx
mov eax, dword [0x4e1620]
cmp byte [eax], 0
je 0x461a62
call fcn.0040bd88
cmp byte [eax + 0x15], 0
je 0x461a4f
mov ebx, pe_nt_image_headers32
jmp 0x461a62
call fcn.0040bd88
cmp byte [eax + 0x14], 0
je 0x461a62
mov ebx, 0x200
lea eax, [ebp - 0x18]
push eax
or ebx, 0x20019
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.004088a8
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x461b11
cmp dword [ebp - 8], 0
jne 0x461a93
xor ebx, ebx
jmp 0x461a9d
mov eax, dword [ebp - 8]
call fcn.004088a8
mov ebx, eax
lea eax, [ebp - 0x20]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x461b08
mov eax, dword [ebp - 0x20]
call fcn.00404568
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x461b00
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x461af6
mov eax, dword [ebp - 0x1c]
mov dword [esi], eax
mov eax, dword [ebp - 0x20]
mov dword [edi], eax
mov byte [ebp - 0xd], 1
jmp 0x461b08
mov eax, dword [ebp - 0x1c]
call fcn.00404584
jmp 0x461b08
mov eax, dword [ebp - 0x1c]
call fcn.00404584
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461b33
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407ac0
ret

Function at 0x461e10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], ecx
mov ebp, edx
mov edi, eax
xor ebx, ebx
xor esi, esi
mov eax, dword [0x4e1620]
cmp byte [eax], 0
je 0x461e54
call fcn.0040bd88
cmp byte [eax + 0x15], 0
je 0x461e41
mov esi, pe_nt_image_headers32
jmp 0x461e54
call fcn.0040bd88
cmp byte [eax + 0x14], 0
je 0x461e54
mov esi, 0x200
lea eax, [esp + 4]
push eax
or esi, 0x20019
push esi
push 0
mov eax, ebp
call fcn.004088a8
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x461e9f
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x10]
call fcn.004088a8
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x461ea8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [edi], eax
xor esi, esi
mov eax, dword [0x4e1620]
cmp byte [eax], 0
je 0x461ef7
call fcn.0040bd88
cmp byte [eax + 0x15], 0
je 0x461ee4
mov esi, pe_nt_image_headers32
jmp 0x461ef7
call fcn.0040bd88
cmp byte [eax + 0x14], 0
je 0x461ef7
mov esi, 0x200
lea eax, [ebp - 0x10]
push eax
or esi, 0x20019
push esi
push 0
mov eax, dword [ebp - 8]
call fcn.004088a8
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x461f6f
cmp dword [ebp - 0xc], 0
jne 0x461f3c
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
jmp 0x461f5d
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.004088a8
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
test bl, bl
je 0x461f66
mov eax, dword [ebp - 0x14]
mov dword [edi], eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x461fec
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, ecx
mov edi, edx
mov esi, eax
mov byte [esp], 0
xor ebx, ebx
mov eax, dword [0x4e1620]
cmp byte [eax], 0
je 0x462031
call fcn.0040bd88
cmp byte [eax + 0x15], 0
je 0x46201e
mov ebx, pe_nt_image_headers32
jmp 0x462031
call fcn.0040bd88
cmp byte [eax + 0x14], 0
je 0x462031
mov ebx, 0x200
lea eax, [esp + 4]
push eax
or ebx, 0x20006
push ebx
push 0
mov eax, edi
call fcn.004088a8
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
mov ebx, eax
push ebx
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x46207b
mov eax, ebp
call fcn.004088a8
push eax
mov eax, dword [esp + 8]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete byte [esp]
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
movzx eax, byte [esp]
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x462088
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [0x4e1620]
cmp byte [eax], 0
jne 0x4620ba
mov eax, dword [ebp - 8]
call fcn.004088a8
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov ebx, eax
jmp 0x46213b
xor eax, eax
push ebp
push 0x46211d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [0x4e1620]
cmp byte [eax], 0
je 0x4620fc
call fcn.0040bd88
cmp byte [eax + 0x15], 0
je 0x4620e9
mov ebx, pe_nt_image_headers32
jmp 0x4620fc
call fcn.0040bd88
cmp byte [eax + 0x14], 0
je 0x4620fc
mov ebx, 0x200
push 0
push ebx
mov eax, dword [ebp - 8]
call fcn.004088a8
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46213b
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x462258
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 0x11], cl
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x462448
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 0x10]
mov eax, 0x462464
call fcn.00408e20
test eax, eax
je 0x462425
cmp byte [ebp - 0x11], 0
je 0x462418
xor edx, edx
push ebp
push 0x46240e
push dword fs:[edx]
mov dword fs:[edx], esp
xor esi, esi
mov eax, dword [0x4e1620]
cmp byte [eax], 0
je 0x4622e6
call fcn.0040bd88
cmp byte [eax + 0x15], 0
je 0x4622d3
mov esi, pe_nt_image_headers32
jmp 0x4622e6
call fcn.0040bd88
cmp byte [eax + 0x14], 0
je 0x4622e6
mov esi, 0x200
lea eax, [ebp - 0x18]
push eax
or esi, 0x2000f
push esi
push 0
mov eax, dword [ebp - 0x10]
call fcn.004088a8
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
xor edx, edx
push ebp
push 0x4623fd
push dword fs:[edx]
mov dword fs:[edx], esp
test eax, eax
jne 0x4623dc
xor eax, eax
mov dword [ebp - 0x20], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryInfoKeyW
test eax, eax
jne 0x4623dc
mov esi, dword [ebp - 0x20]
dec esi
cmp esi, 0
jl 0x4623dc
mov eax, dword [0x4dff58]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x1c]
call fcn.00408a2c
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
call fcn.00408018
push eax
push esi
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x4623d2
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x1c]
call fcn.00408a2c
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x10]
call fcn.00424794
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
call fcn.00408b04
movzx ecx, byte [ebp - 0x11]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00462258
test al, al
jne 0x4623d2
call fcn.0040724c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x462425
dec esi
cmp esi, 0xffffffff
jne 0x462356
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462404
lea eax, [ebp - 4]
xor edx, edx
call fcn.00408a2c
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00462144
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46244f
lea eax, [ebp - 0x24]
call fcn.00407a60
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407ac0
ret
Function at 0x4628c0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 8], 0
mov eax, dword [ebp - 4]
add eax, 0x14
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.004088a8
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], ebx
test ebx, ebx
jbe 0x46296e
xor eax, eax
push ebp
push 0x46295d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404568
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], esi
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, esi
xor ecx, ecx
call fcn.00404f7c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.004088a8
push eax
call sub.version.dll_GetFileVersionInfoW
cmp eax, 1
sbb eax, eax
inc eax
mov edx, dword [ebp - 4]
mov byte [edx + 8], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46296e
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x462ca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x462d76
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor esi, esi
push ebp
push 0x462d49
push dword fs:[esi]
mov dword fs:[esi], esp
test dl, dl
je 0x462cfa
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.004089a4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0041ceb8
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, 0xfde9
call fcn.00408204
jmp 0x462d09
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0xfde9
call fcn.00408560
mov eax, 1
mov edx, dword [ebp - 4]
test edx, edx
je 0x462d1a
sub edx, 4
mov edx, dword [edx]
test edx, edx
jle 0x462d3c
mov ecx, 1
imul eax, eax, 0x5517e877
mov ebx, dword [ebp - 4]
movzx ebx, byte [ebx + ecx - 1]
xor eax, dword [ebx*4 + 0x4dff5c]
inc ecx
dec edx
jne 0x462d23
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x462d53
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462d7d
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00407b20
lea eax, [ebp - 4]
call fcn.00407a84
ret
Function at 0x462d88
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x462ea8
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor ecx, ecx
push ebp
push 0x462e7b
push dword fs:[ecx]
mov dword fs:[ecx], esp
test dl, dl
je 0x462df3
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.004089a4
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0041ceb8
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov ecx, 0xfde9
call fcn.00408204
jmp 0x462e02
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0xfde9
call fcn.00408560
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x462e1c
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x462e65
mov esi, 1
push 0
push 0x5517e877
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.004097f0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi - 1]
mov edx, dword [eax*8 + 0x4e0364]
mov eax, dword [eax*8 + 0x4e0360]
xor eax, dword [ebp - 0x18]
xor edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
inc esi
dec ebx
jne 0x462e27
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x462e85
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462eaf
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00407b20
lea eax, [ebp - 4]
call fcn.00407a84
ret
Function at 0x466180
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x466248
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00407a60
xor eax, eax
push ebp
push 0x466222
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, esi
call fcn.004088a8
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov ebx, eax
test ebx, ebx
jle 0x466218
inc ebx
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x466154]
call fcn.00409d9c
add esp, 4
push ebx
mov eax, dword [ebp - 4]
push eax
mov eax, esi
call fcn.004088a8
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
test eax, eax
je 0x466200
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00408900
push 0
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x466154]
call fcn.00409d9c
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46622c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46624f
lea eax, [ebp - 4]
mov edx, dword [0x466154]
call fcn.00409ec0
ret

Function at 0x469eec
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x469f88
push 0
mov eax, ebx
call fcn.004088a8
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
test ebx, ebx
jne 0x469f63
mov ebx, esi
test ebx, ebx
je 0x469f35
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.004088a8
push eax
push 1
push 0
mov eax, edi
call fcn.004088a8
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x469f7e
mov ecx, dword [0x4e1734]
mov dl, 1
mov eax, dword [0x468434]
call fcn.00423730
call fcn.00407158
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x46af3c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46b00b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407a60
xor edx, edx
push ebp
push 0x46afe8
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xff
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
test eax, eax
je 0x46afde
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.00408900
mov eax, dword [ebx]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
test eax, eax
je 0x46afae
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x46afc4
mov eax, ebx
mov edx, 0x46b028
call fcn.00408aac
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0046aeec
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00407e40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46aff2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b012
lea eax, [ebp - 0x208]
call fcn.00407a60
ret

Function at 0x46b02c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46b0fb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407a60
xor edx, edx
push ebp
push 0x46b0d8
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xff
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
test eax, eax
je 0x46b0ce
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.00408900
mov eax, dword [ebx]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
test eax, eax
je 0x46b09e
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x46b0b4
mov eax, ebx
mov edx, 0x46b118
call fcn.00408aac
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0046aeec
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00407e40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46b0e2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b102
lea eax, [ebp - 0x208]
call fcn.00407a60
ret
Function at 0x46b11c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x218], edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46b227
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407a60
xor edx, edx
push ebp
push 0x46b1f9
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x4e1620]
cmp byte [eax], 0
jne 0x46b179
mov eax, ebx
call fcn.0046b02c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46b203
push 0x104
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_GetSystemWow64DirectoryW
test eax, eax
je 0x46b1ef
mov eax, ebx
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00408954
lea edx, [ebp - 0x210]
mov eax, dword [ebx]
call fcn.0046aeec
mov edx, dword [ebp - 0x210]
mov eax, ebx
call fcn.00407e40
mov eax, dword [ebx]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x46b1d1
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x46b1ef
lea edx, [ebp - 0x218]
mov eax, dword [ebx]
call fcn.00424794
mov edx, dword [ebp - 0x218]
mov eax, ebx
call fcn.00407e40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46b203
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b22e
lea eax, [ebp - 0x218]
call fcn.00407a60
lea eax, [ebp - 0x210]
call fcn.00407a60
ret

Function at 0x46b338
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov dword [ebp - 0x204], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46b42c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407a60
xor edx, edx
push ebp
push 0x46b404
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x200]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathW
test eax, eax
je 0x46b3fa
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.00408900
lea edx, [ebp - 0x204]
mov eax, dword [ebx]
call fcn.0046f610
mov edx, dword [ebp - 0x204]
mov eax, ebx
call fcn.00407e40
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0046aeec
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00407e40
mov eax, dword [ebx]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
test eax, eax
je 0x46b3e4
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x46b3fa
mov eax, ebx
mov edx, 0x46b448
call fcn.00408aac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46b40e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b433
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.00407ac0
ret