joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472e7c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x5c532f
call fcn.004b8fa6
xor edi, edi
mov dword [ebp - 0x18], 0x104
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
call fcn.0046b532
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], edi
call fcn.0046b566
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
lea eax, [ebp - 0x10]
push eax
je 0x472eea
mov ebx, 0xf013f
jmp 0x472eef
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
push edi
push edi
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x14]
test eax, eax
je 0x472f20
call esi
push dword [ebp - 0x10]
call esi
jmp 0x472f2a
mov ebx, 0xf003f
push ebx
push edi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x472f2a
lea eax, [ebp - 0x14]
push eax
push ebx
push edi
push str.SmartCloud
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x472ebf
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x472f2a
call esi
push dword [ebp - 0x10]
call esi
xor edi, edi
inc edi
lea ecx, [ebp - 0x3c]
call fcn.0046b545
mov eax, edi
call fcn.004b8f6f
ret 8

Function at 0x4730b7
Capabilities:
Read .ini file

Disassembly:
push 0x82c
mov eax, 0x5c536c
call fcn.004b8fda
mov edi, ecx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp + 0x10]
push 0x800
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x810]
push ecx
push eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], ecx
call fcn.005991a0
lea eax, [edi + 0xd0]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x473114
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.00420790
and dword [ebp - 4], 0
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x834], 1
jb 0x47315a
mov eax, dword [esi]
jmp 0x47315c
mov eax, esi
push ebx
push eax
call fcn.0059c3ba
pop ecx
pop ecx
test eax, eax
jne 0x4731a8
cmp byte [edi + 5], 0
lea eax, [ebp - 0x828]
push ebx
push dword [ebp - 0x82c]
mov ecx, edi
push dword [ebp - 0x830]
push eax
je 0x47318c
call fcn.00472f94
jmp 0x473191
call fcn.0047304e
push eax
mov ecx, esi
call fcn.00422a50
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.004208a0
mov eax, esi
call fcn.004b8f84
ret 0x10
Function at 0x473294
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6554f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, ecx
push 0
push eax
call fcn.005991a0
add esi, 0x28
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x4732cb
mov esi, dword [esi]
push str.AllSkin
push esi
lea eax, [ebp - 0x20c]
push 0x5c8c9c
push eax
call fcn.0044b4c4
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop esi
test eax, eax
jne 0x473304
lea eax, [ebp - 0x20c]
push eax
call fcn.0043b037
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b8f5e
mov esp, ebp
pop ebp
ret

Function at 0x473312
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6554f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea eax, [esi + 0x28]
cmp dword [eax + 0x14], 8
jb 0x473333
mov eax, dword [eax]
push str.Config
push eax
lea eax, [ebp - 0x20c]
push 0x5c8c9c
push eax
call fcn.0044b4c4
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x47336b
lea eax, [ebp - 0x20c]
push eax
call fcn.0043b037
pop ecx
lea eax, [ebp - 0x20c]
push str.Related.ini
push eax
call fcn.0059c389
cmp word [ebp - 0x20c], 0
pop ecx
pop ecx
jne 0x47338c
xor eax, eax
jmp 0x473399
lea eax, [ebp - 0x20c]
push eax
call fcn.0059c41c
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0xb8]
call fcn.00420960
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004b8f5e
mov esp, ebp
pop ebp
ret
Function at 0x4733bb
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc3c
mov eax, dword [0x6554f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0xc34]
push esi
push edi
push 0x208
xor edi, edi
mov esi, ecx
push edi
push eax
mov dword [ebp - 0xc3c], esi
call fcn.005991a0
push 0x208
lea eax, [ebp - 0x824]
push edi
push eax
call fcn.005991a0
push 0x208
lea eax, [ebp - 0x61c]
push edi
push eax
call fcn.005991a0
push 0x208
lea eax, [ebp - 0xa2c]
push edi
push eax
call fcn.005991a0
push 0x208
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.005991a0
push 0x208
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.005991a0
add esp, 0x48
lea eax, [ebp - 0xc34]
mov ecx, esi
push edi
push 0x1a
push eax
push edi
call fcn.00474d54
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0059c3fa
lea eax, [ebp - 0x20c]
push eax
call fcn.0059c41c
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.005993a8
add esp, 0x14
test eax, eax
jne 0x47349a
mov ecx, esi
jmp 0x4735dc
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push eax
call fcn.0059c3fa
lea eax, [ebp - 0x824]
push 0x5ceaa8
push eax
call fcn.0059c389
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ecx, ecx
mov esi, edi
inc ecx
test eax, eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
cmovne esi, ecx
push eax
call fcn.0059c3fa
lea eax, [ebp - 0x61c]
push str.LocalLow
push eax
call fcn.0059c389
add esp, 0x10
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov ecx, edi
push 1
pop eax
cmovne ecx, eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa2c]
mov dword [ebp - 0xc38], ecx
push eax
call fcn.0059c3fa
lea eax, [ebp - 0xa2c]
push str.Roaming
push eax
call fcn.0059c389
add esp, 0x10
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov ecx, edi
push 1
pop eax
cmovne ecx, eax
test esi, esi
je 0x4735d6
cmp dword [ebp - 0xc38], edi
je 0x4735d6
test ecx, ecx
je 0x4735d6
push str.SmartCloudIME
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push str._s_s_
push eax
call fcn.0044b4c4
add esp, 0x10
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4735ad
lea eax, [ebp - 0x414]
push eax
call fcn.0043b037
pop ecx
cmp word [ebp - 0x414], di
je 0x4735c5
lea eax, [ebp - 0x414]
push eax
call fcn.0059c41c
pop ecx
mov edi, eax
push edi
lea eax, [ebp - 0x414]
mov ecx, ebx
push eax
call fcn.00420960
jmp 0x4735e2
mov ecx, dword [ebp - 0xc3c]
push ebx
call fcn.00472840
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b8f5e
mov esp, ebp
pop ebp
ret 4
Function at 0x4735f5
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc3c
mov eax, dword [0x6554f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0xc34]
push esi
push edi
push 0x208
xor edi, edi
mov esi, ecx
push edi
push eax
mov dword [ebp - 0xc3c], esi
call fcn.005991a0
push 0x208
lea eax, [ebp - 0x824]
push edi
push eax
call fcn.005991a0
push 0x208
lea eax, [ebp - 0x61c]
push edi
push eax
call fcn.005991a0
push 0x208
lea eax, [ebp - 0xa2c]
push edi
push eax
call fcn.005991a0
push 0x208
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.005991a0
push 0x208
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.005991a0
add esp, 0x48
lea eax, [ebp - 0xc34]
mov ecx, esi
push edi
push 0x1a
push eax
push edi
call fcn.00474d54
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0059c3fa
lea eax, [ebp - 0x20c]
push eax
call fcn.0059c41c
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.005993a8
add esp, 0x14
test eax, eax
jne 0x4736d4
mov ecx, esi
jmp 0x473816
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push eax
call fcn.0059c3fa
lea eax, [ebp - 0x824]
push 0x5ceaa8
push eax
call fcn.0059c389
add esp, 0x10
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ecx, ecx
mov esi, edi
inc ecx
test eax, eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
cmovne esi, ecx
push eax
call fcn.0059c3fa
lea eax, [ebp - 0x61c]
push str.LocalLow
push eax
call fcn.0059c389
add esp, 0x10
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov ecx, edi
push 1
pop eax
cmovne ecx, eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa2c]
mov dword [ebp - 0xc38], ecx
push eax
call fcn.0059c3fa
lea eax, [ebp - 0xa2c]
push str.Roaming
push eax
call fcn.0059c389
add esp, 0x10
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov ecx, edi
push 1
pop eax
cmovne ecx, eax
test esi, esi
je 0x473810
cmp dword [ebp - 0xc38], edi
je 0x473810
test ecx, ecx
je 0x473810
push str.SmartCloudIME.users
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push str._s_s_
push eax
call fcn.0044b4c4
add esp, 0x10
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4737e7
lea eax, [ebp - 0x414]
push eax
call fcn.0043b037
pop ecx
cmp word [ebp - 0x414], di
je 0x4737ff
lea eax, [ebp - 0x414]
push eax
call fcn.0059c41c
pop ecx
mov edi, eax
push edi
lea eax, [ebp - 0x414]
mov ecx, ebx
push eax
call fcn.00420960
jmp 0x47381c
mov ecx, dword [ebp - 0xc3c]
push ebx
call fcn.00472907
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b8f5e
mov esp, ebp
pop ebp
ret 4
Function at 0x473961
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6554f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x20c]
push edi
push eax
mov esi, ecx
call fcn.005991a0
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ecx, esi
push 0x104
push eax
call fcn.00473087
test al, al
jne 0x4739b7
push edi
push 0x1a
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [ebp - 0x20c], di
je 0x4739cf
lea eax, [ebp - 0x20c]
push eax
call fcn.0059c41c
pop ecx
mov edi, eax
push edi
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0x160]
call fcn.00420960
mov edi, 0x626e18
push edi
call fcn.0059c41c
pop ecx
push eax
push edi
lea ecx, [esi + 0x160]
call fcn.00422d00
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004b8f5e
mov esp, ebp
pop ebp
ret

Function at 0x473a0b
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6554f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x20c]
push edi
push eax
mov esi, ecx
call fcn.005991a0
add esp, 0xc
lea eax, [ebp - 0x20c]
push edi
push 0x26
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [ebp - 0x20c], di
je 0x473a62
lea eax, [ebp - 0x20c]
push eax
call fcn.0059c41c
pop ecx
mov edi, eax
push edi
lea eax, [ebp - 0x20c]
add esi, 0x148
push eax
mov ecx, esi
call fcn.00420960
mov edi, 0x626e18
push edi
call fcn.0059c41c
pop ecx
push eax
push edi
mov ecx, esi
call fcn.00422d00
cmp dword [esi + 0x14], 8
jb 0x473a96
mov eax, dword [esi]
jmp 0x473a98
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x473ab8
mov edi, str.C:Program_Files_
push edi
call fcn.0059c41c
pop ecx
push eax
push edi
mov ecx, esi
call fcn.00420960
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004b8f5e
mov esp, ebp
pop ebp
ret
Function at 0x4745a6
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6554f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea eax, [esi + 0x28]
cmp dword [eax + 0x14], 8
jb 0x4745c7
mov eax, dword [eax]
push str.UseData
push eax
lea eax, [ebp - 0x20c]
push 0x5c8c9c
push eax
call fcn.0044b4c4
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4745ff
lea eax, [ebp - 0x20c]
push eax
call fcn.0043b037
pop ecx
cmp word [ebp - 0x20c], 0
jne 0x47460d
xor eax, eax
jmp 0x47461a
lea eax, [ebp - 0x20c]
push eax
call fcn.0059c41c
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0xe8]
call fcn.00420960
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004b8f5e
mov esp, ebp
pop ebp
ret

Function at 0x4746e1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6554f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x6660f0]
test al, al
jne 0x47477a
push ebx
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.005991a0
add esp, 0xc
lea eax, [ebp - 0x20c]
xor ebx, ebx
inc ebx
push ebx
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x474771
lea eax, [ebp - 0x20c]
push eax
call fcn.0059c79f
lea eax, [ebp - 0x20c]
mov dword [esp], str.config_systemprofile
push eax
call fcn.00599449
pop ecx
pop ecx
test eax, eax
jne 0x474769
lea eax, [ebp - 0x20c]
push str.cocuments_and_settingslocalService
push eax
call fcn.00599449
pop ecx
pop ecx
test eax, eax
je 0x474771
mov byte [0x6660f0], bl
jmp 0x474777
mov bl, byte [0x6660f0]
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b8f5e
mov esp, ebp
pop ebp
ret
Function at 0x474c52
Capabilities:
Read .ini file

Disassembly:
push 0x224
mov eax, 0x5c26e4
call fcn.004b8fda
mov esi, ecx
call fcn.00472f79
lea edi, [esi + 0x100]
push eax
mov ecx, edi
call fcn.00420910
mov ebx, str.SmartCloudInfo.ini
push ebx
call fcn.0059c41c
pop ecx
push eax
push ebx
mov ecx, edi
call fcn.00422d00
push 0x5ca380
push str.Spreader
push str.AppInfo
lea eax, [ebp - 0x230]
mov ecx, esi
push eax
call fcn.00473024
xor ebx, ebx
lea eax, [ebp - 0x230]
add esi, 0x118
mov dword [ebp - 4], ebx
cmp esi, eax
je 0x474cc8
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
call fcn.00420e60
push 0x5ca380
mov ecx, esi
call fcn.0043ec1f
test eax, eax
jne 0x474d40
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.005991a0
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x474cf5
mov edi, dword [edi]
push edi
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0x5ca380
push str.Spreader
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], bx
jne 0x474d24
mov eax, ebx
jmp 0x474d31
lea eax, [ebp - 0x218]
push eax
call fcn.0059c41c
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00420960
push ebx
push 1
lea ecx, [ebp - 0x230]
call fcn.004208a0
call fcn.004b8f84
ret
Function at 0x4775f8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x64
push esi
mov dword [ebp - 4], esi
call sub.NETAPI32.dll_NetWkstaGetInfo
test eax, eax
jne 0x47762f
mov eax, dword [ebp - 4]
push eax
mov esi, dword [eax + 0xc]
mov edi, dword [eax + 0x10]
call sub.NETAPI32.dll_NetApiBufferFree
movzx ecx, si
shl ecx, 0x10
movzx eax, di
or eax, ecx
jmp 0x477692
push 2
push esi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x477690
push 0x10
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x477689
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x477689
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x477688
push 0x5cee6c
lea eax, [ebx + 6]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x477688
cmp word [ebx + 2], si
jbe 0x477688
mov esi, dword [ebx + 0x30]
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x477ab0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x5c532f
call fcn.004b8fa6
xor esi, esi
mov dword [ebp - 0x18], 0x104
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.0046b532
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
call fcn.0046b566
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x477af0
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x477b50
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x477b2b
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x477b50
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x3c]
call fcn.0046b545
call fcn.004b8f6f
ret 0xc
Function at 0x47843c
Capabilities:
Get common file path

Disassembly:
push 0x240
mov eax, 0x5c5937
call fcn.004b8fda
mov ebx, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
xor esi, esi
mov dword [ebp - 0x24c], edi
push esi
push eax
call fcn.005991a0
add esp, 0xc
lea eax, [ebp - 0x218]
push esi
push 0x19
push eax
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call esi
test eax, eax
je 0x478533
and dword [ebp - 0x220], 0
xor eax, eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
je 0x4784b8
lea eax, [ebp - 0x218]
push eax
call fcn.0059c41c
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00420960
and dword [ebp - 4], 0
push 0x626e18
call fcn.0059c41c
pop ecx
push eax
push 0x626e18
lea ecx, [ebp - 0x230]
call fcn.00422d00
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push edi
cmovae eax, dword [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.004780fe
mov edi, eax
lea ecx, [ebp - 0x230]
push 0
push 1
test edi, edi
je 0x478524
call fcn.004208a0
mov eax, edi
jmp 0x4785e5
or dword [ebp - 4], 0xffffffff
call fcn.004208a0
mov edi, dword [ebp - 0x24c]
push 0
push 0x10
lea eax, [ebp - 0x218]
push eax
push 0
call esi
test eax, eax
je 0x4785e3
and dword [ebp - 0x238], 0
xor eax, eax
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], ax
cmp word [ebp - 0x218], ax
je 0x47857a
lea eax, [ebp - 0x218]
push eax
call fcn.0059c41c
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.00420960
mov esi, 0x626e18
mov dword [ebp - 4], 1
push esi
call fcn.0059c41c
pop ecx
push eax
push esi
lea ecx, [ebp - 0x248]
call fcn.00422d00
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
push edi
cmovae eax, dword [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.004780fe
push 0
lea ecx, [ebp - 0x248]
mov esi, eax
push 1
call fcn.004208a0
test esi, esi
je 0x4785e3
mov eax, esi
jmp 0x4785e5
xor eax, eax
call fcn.004b8f84
ret 4
Function at 0x4785ed
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x6554f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x428], eax
xor edi, edi
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], edi
push eax
push 9
push edi
push 0x5c8f00
push reloc.WS2_32.dll_accept
mov esi, edi
mov dword [ebp - 0x41c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x478640
xor eax, eax
jmp 0x47873f
push ebx
push 0x208
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.005991a0
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ebx, edi
push 0x104
push eax
push edi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47872c
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x478712
push 0x208
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x420], 0x104
push eax
call fcn.005991a0
add esp, 0xc
xor eax, eax
inc eax
mov dword [ebp - 0x424], eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x424]
push eax
push 0
push str.DisplayName
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x47870a
push dword [ebp - 0x428]
lea eax, [ebp - 0x414]
push eax
call fcn.00599449
pop ecx
pop ecx
test eax, eax
push 1
pop eax
cmovne esi, eax
push dword [ebp - 0x41c]
call edi
push 0x104
lea eax, [ebp - 0x20c]
inc ebx
push eax
push ebx
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x47867c
push dword [ebp - 0x418]
call edi
mov eax, esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004b8f5e
mov esp, ebp
pop ebp
ret 4
Function at 0x479083
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x6554f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x420], eax
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x42c], ecx
push ebx
push eax
mov esi, ebx
mov dword [ebp - 0x418], ebx
mov dword [ebp - 0x41c], ebx
call fcn.005991a0
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
push 0x109
push ebx
push 0x5c8f00
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4791d4
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ebx
jmp 0x4791ae
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4791a0
push 0x208
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x424], 0x104
push eax
call fcn.005991a0
add esp, 0xc
xor eax, eax
inc eax
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x428]
push eax
push 0
push str.DisplayName
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x479198
push dword [ebp - 0x420]
lea eax, [ebp - 0x414]
push eax
call fcn.00599449
pop ecx
pop ecx
test eax, eax
push 1
pop eax
cmovne esi, eax
push dword [ebp - 0x41c]
call edi
push 0x104
lea eax, [ebp - 0x20c]
inc ebx
push eax
push ebx
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x47910a
push dword [ebp - 0x418]
call edi
test esi, esi
jne 0x4792e0
xor ebx, ebx
lea eax, [ebp - 0x418]
push eax
push 9
push ebx
push 0x5c8f88
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4792cd
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
jmp 0x4792ad
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x47929f
push 0x208
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x428], 0x104
push eax
call fcn.005991a0
add esp, 0xc
xor eax, eax
inc eax
mov dword [ebp - 0x424], eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x424]
push eax
push 0
push str.DisplayName
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x479297
push dword [ebp - 0x420]
lea eax, [ebp - 0x414]
push eax
call fcn.00599449
pop ecx
pop ecx
test eax, eax
push 1
pop eax
cmovne esi, eax
push dword [ebp - 0x41c]
call edi
push 0x104
lea eax, [ebp - 0x20c]
inc ebx
push eax
push ebx
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x479209
push dword [ebp - 0x418]
call edi
test esi, esi
jne 0x4792e0
push dword [ebp - 0x420]
mov ecx, dword [ebp - 0x42c]
call fcn.004785ed
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b8f5e
mov esp, ebp
pop ebp
ret 4