joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462774
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00407b44
mov eax, dword [ebp - 8]
call fcn.00407b44
xor eax, eax
push ebp
push 0x4628b4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [edi], eax
xor ebx, ebx
mov eax, dword [0x4e96a8]
cmp byte [eax], 0
je 0x4627ea
call fcn.0040beb8
cmp byte [eax + 0x15], 0
je 0x4627d7
mov ebx, pe_nt_image_headers32
jmp 0x4627ea
call fcn.0040beb8
cmp byte [eax + 0x14], 0
je 0x4627ea
mov ebx, 0x200
lea eax, [ebp - 0x18]
push eax
or ebx, 0x20019
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.004088f4
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x462899
cmp dword [ebp - 8], 0
jne 0x46281b
xor ebx, ebx
jmp 0x462825
mov eax, dword [ebp - 8]
call fcn.004088f4
mov ebx, eax
lea eax, [ebp - 0x20]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x462890
mov eax, dword [ebp - 0x20]
call fcn.00404568
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x462888
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x46287e
mov eax, dword [ebp - 0x1c]
mov dword [esi], eax
mov eax, dword [ebp - 0x20]
mov dword [edi], eax
mov byte [ebp - 0xd], 1
jmp 0x462890
mov eax, dword [ebp - 0x1c]
call fcn.00404584
jmp 0x462890
mov eax, dword [ebp - 0x1c]
call fcn.00404584
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4628bb
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407ac0
ret

Function at 0x462b98
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], ecx
mov ebp, edx
mov edi, eax
xor ebx, ebx
xor esi, esi
mov eax, dword [0x4e96a8]
cmp byte [eax], 0
je 0x462bdc
call fcn.0040beb8
cmp byte [eax + 0x15], 0
je 0x462bc9
mov esi, pe_nt_image_headers32
jmp 0x462bdc
call fcn.0040beb8
cmp byte [eax + 0x14], 0
je 0x462bdc
mov esi, 0x200
lea eax, [esp + 4]
push eax
or esi, 0x20019
push esi
push 0
mov eax, ebp
call fcn.004088f4
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x462c27
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x10]
call fcn.004088f4
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x462c30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [edi], eax
xor esi, esi
mov eax, dword [0x4e96a8]
cmp byte [eax], 0
je 0x462c7f
call fcn.0040beb8
cmp byte [eax + 0x15], 0
je 0x462c6c
mov esi, pe_nt_image_headers32
jmp 0x462c7f
call fcn.0040beb8
cmp byte [eax + 0x14], 0
je 0x462c7f
mov esi, 0x200
lea eax, [ebp - 0x10]
push eax
or esi, 0x20019
push esi
push 0
mov eax, dword [ebp - 8]
call fcn.004088f4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x462cf7
cmp dword [ebp - 0xc], 0
jne 0x462cc4
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
jmp 0x462ce5
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.004088f4
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
test bl, bl
je 0x462cee
mov eax, dword [ebp - 0x14]
mov dword [edi], eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x462d74
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, ecx
mov edi, edx
mov esi, eax
mov byte [esp], 0
xor ebx, ebx
mov eax, dword [0x4e96a8]
cmp byte [eax], 0
je 0x462db9
call fcn.0040beb8
cmp byte [eax + 0x15], 0
je 0x462da6
mov ebx, pe_nt_image_headers32
jmp 0x462db9
call fcn.0040beb8
cmp byte [eax + 0x14], 0
je 0x462db9
mov ebx, 0x200
lea eax, [esp + 4]
push eax
or ebx, 0x20006
push ebx
push 0
mov eax, edi
call fcn.004088f4
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
mov ebx, eax
push ebx
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x462e03
mov eax, ebp
call fcn.004088f4
push eax
mov eax, dword [esp + 8]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete byte [esp]
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
movzx eax, byte [esp]
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x462e10
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [0x4e96a8]
cmp byte [eax], 0
jne 0x462e42
mov eax, dword [ebp - 8]
call fcn.004088f4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov ebx, eax
jmp 0x462ec3
xor eax, eax
push ebp
push 0x462ea5
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [0x4e96a8]
cmp byte [eax], 0
je 0x462e84
call fcn.0040beb8
cmp byte [eax + 0x15], 0
je 0x462e71
mov ebx, pe_nt_image_headers32
jmp 0x462e84
call fcn.0040beb8
cmp byte [eax + 0x14], 0
je 0x462e84
mov ebx, 0x200
push 0
push ebx
mov eax, dword [ebp - 8]
call fcn.004088f4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x462ec3
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x462fe0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 0x11], cl
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4631d0
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 0x10]
mov eax, 0x4631ec
call fcn.00408e6c
test eax, eax
je 0x4631ad
cmp byte [ebp - 0x11], 0
je 0x4631a0
xor edx, edx
push ebp
push 0x463196
push dword fs:[edx]
mov dword fs:[edx], esp
xor esi, esi
mov eax, dword [0x4e96a8]
cmp byte [eax], 0
je 0x46306e
call fcn.0040beb8
cmp byte [eax + 0x15], 0
je 0x46305b
mov esi, pe_nt_image_headers32
jmp 0x46306e
call fcn.0040beb8
cmp byte [eax + 0x14], 0
je 0x46306e
mov esi, 0x200
lea eax, [ebp - 0x18]
push eax
or esi, 0x2000f
push esi
push 0
mov eax, dword [ebp - 0x10]
call fcn.004088f4
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
xor edx, edx
push ebp
push 0x463185
push dword fs:[edx]
mov dword fs:[edx], esp
test eax, eax
jne 0x463164
xor eax, eax
mov dword [ebp - 0x20], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryInfoKeyW
test eax, eax
jne 0x463164
mov esi, dword [ebp - 0x20]
dec esi
cmp esi, 0
jl 0x463164
mov eax, dword [0x4e7f9c]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x1c]
call fcn.00408a78
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
call fcn.00408018
push eax
push esi
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x46315a
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x1c]
call fcn.00408a78
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x10]
call fcn.004248f4
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
call fcn.00408b50
movzx ecx, byte [ebp - 0x11]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00462fe0
test al, al
jne 0x46315a
call fcn.0040724c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4631ad
dec esi
cmp esi, 0xffffffff
jne 0x4630de
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46318c
lea eax, [ebp - 4]
xor edx, edx
call fcn.00408a78
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00462ecc
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4631d7
lea eax, [ebp - 0x24]
call fcn.00407a60
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407ac0
ret
Function at 0x463648
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 8], 0
mov eax, dword [ebp - 4]
add eax, 0x14
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.004088f4
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], ebx
test ebx, ebx
jbe 0x4636f6
xor eax, eax
push ebp
push 0x4636e5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404568
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], esi
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, esi
xor ecx, ecx
call fcn.00404f7c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.004088f4
push eax
call sub.version.dll_GetFileVersionInfoW
cmp eax, 1
sbb eax, eax
inc eax
mov edx, dword [ebp - 4]
mov byte [edx + 8], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4636f6
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x463ab8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x463b8e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor esi, esi
push ebp
push 0x463b61
push dword fs:[esi]
mov dword fs:[esi], esp
test dl, dl
je 0x463b12
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.004089f0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0041d018
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, 0xfde9
call fcn.00408204
jmp 0x463b21
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0xfde9
call fcn.004085ac
mov eax, 1
mov edx, dword [ebp - 4]
test edx, edx
je 0x463b32
sub edx, 4
mov edx, dword [edx]
test edx, edx
jle 0x463b54
mov ecx, 1
imul eax, eax, 0x5517e877
mov ebx, dword [ebp - 4]
movzx ebx, byte [ebx + ecx - 1]
xor eax, dword [ebx*4 + 0x4e7fa0]
inc ecx
dec edx
jne 0x463b3b
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x463b6b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463b95
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00407b20
lea eax, [ebp - 4]
call fcn.00407a84
ret
Function at 0x463ba0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x463cc0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor ecx, ecx
push ebp
push 0x463c93
push dword fs:[ecx]
mov dword fs:[ecx], esp
test dl, dl
je 0x463c0b
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.004089f0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0041d018
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov ecx, 0xfde9
call fcn.00408204
jmp 0x463c1a
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0xfde9
call fcn.004085ac
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x463c34
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x463c7d
mov esi, 1
push 0
push 0x5517e877
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.0040983c
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi - 1]
mov edx, dword [eax*8 + 0x4e83a4]
mov eax, dword [eax*8 + 0x4e83a0]
xor eax, dword [ebp - 0x18]
xor edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
inc esi
dec ebx
jne 0x463c3f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x463c9d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463cc7
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00407b20
lea eax, [ebp - 4]
call fcn.00407a84
ret
Function at 0x466f98
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x467060
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00407a60
xor eax, eax
push ebp
push 0x46703a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, esi
call fcn.004088f4
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov ebx, eax
test ebx, ebx
jle 0x467030
inc ebx
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x466f6c]
call fcn.00409de8
add esp, 4
push ebx
mov eax, dword [ebp - 4]
push eax
mov eax, esi
call fcn.004088f4
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
test eax, eax
je 0x467018
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.0040894c
push 0
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x466f6c]
call fcn.00409de8
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x467044
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467067
lea eax, [ebp - 4]
mov edx, dword [0x466f6c]
call fcn.00409f0c
ret

Function at 0x46ad04
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x46ada0
push 0
mov eax, ebx
call fcn.004088f4
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
test ebx, ebx
jne 0x46ad7b
mov ebx, esi
test ebx, ebx
je 0x46ad4d
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.004088f4
push eax
push 1
push 0
mov eax, edi
call fcn.004088f4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x46ad96
mov ecx, dword [0x4e97c0]
mov dl, 1
mov eax, dword [0x46924c]
call fcn.00423890
call fcn.00407158
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x46bd54
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46be23
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407a60
xor edx, edx
push ebp
push 0x46be00
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xff
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
test eax, eax
je 0x46bdf6
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.0040894c
mov eax, dword [ebx]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
test eax, eax
je 0x46bdc6
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x46bddc
mov eax, ebx
mov edx, 0x46be40
call fcn.00408af8
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0046bd04
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00407e40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46be0a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46be2a
lea eax, [ebp - 0x208]
call fcn.00407a60
ret

Function at 0x46be44
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46bf13
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407a60
xor edx, edx
push ebp
push 0x46bef0
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xff
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
test eax, eax
je 0x46bee6
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.0040894c
mov eax, dword [ebx]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
test eax, eax
je 0x46beb6
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x46becc
mov eax, ebx
mov edx, 0x46bf30
call fcn.00408af8
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0046bd04
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00407e40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46befa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46bf1a
lea eax, [ebp - 0x208]
call fcn.00407a60
ret
Function at 0x46bf34
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x218], edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46c03f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407a60
xor edx, edx
push ebp
push 0x46c011
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x4e96a8]
cmp byte [eax], 0
jne 0x46bf91
mov eax, ebx
call fcn.0046be44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46c01b
push 0x104
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_GetSystemWow64DirectoryW
test eax, eax
je 0x46c007
mov eax, ebx
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.004089a0
lea edx, [ebp - 0x210]
mov eax, dword [ebx]
call fcn.0046bd04
mov edx, dword [ebp - 0x210]
mov eax, ebx
call fcn.00407e40
mov eax, dword [ebx]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x46bfe9
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x46c007
lea edx, [ebp - 0x218]
mov eax, dword [ebx]
call fcn.004248f4
mov edx, dword [ebp - 0x218]
mov eax, ebx
call fcn.00407e40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46c01b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c046
lea eax, [ebp - 0x218]
call fcn.00407a60
lea eax, [ebp - 0x210]
call fcn.00407a60
ret

Function at 0x46c150
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov dword [ebp - 0x204], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46c244
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407a60
xor edx, edx
push ebp
push 0x46c21c
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x200]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathW
test eax, eax
je 0x46c212
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.0040894c
lea edx, [ebp - 0x204]
mov eax, dword [ebx]
call fcn.00470428
mov edx, dword [ebp - 0x204]
mov eax, ebx
call fcn.00407e40
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0046bd04
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00407e40
mov eax, dword [ebx]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
test eax, eax
je 0x46c1fc
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x46c212
mov eax, ebx
mov edx, 0x46c260
call fcn.00408af8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46c226
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c24b
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.00407ac0
ret
Function at 0x46c264
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00407a60
xor edx, edx
push ebp
push 0x46c2f1
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x402]
push eax
push 0
push 0
push esi
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, 0x80000000
sete al
test al, al
je 0x46c2e7
mov edx, ebx
lea eax, [ebp - 0x402]
call fcn.0041efc4
cmp dword [ebx], 0
je 0x46c2e7
mov eax, dword [ebx]
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0x408]
test eax, eax
je 0x46c2d1
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x46c2e7
mov eax, ebx
mov edx, 0x46c310
call fcn.00408af8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46c2fb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46cb34
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x46ccaf
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x46cc87
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.0046011c
cmp al, 0xa
jb 0x46cc17
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00408a78
xor edx, edx
push ebp
push 0x46cc10
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004088f4
push eax
push 0
push 0
push 0x23
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x46cbf8
mov eax, dword [ebp - 4]
call fcn.004088f4
mov edx, dword [ebp - 8]
call fcn.0041efc4
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x46cbca
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x46cbe6
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004248f4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00407e40
call fcn.0040724c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46cc91
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46cc17
lea eax, [ebp - 4]
xor edx, edx
call fcn.00408a78
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x4e97b8]
mov eax, dword [eax]
mov ecx, 0x46cccc
mov edx, 0x46ccf8
call fcn.00462994
test al, al
je 0x46cc7d
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x46cc4b
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x46cc7d
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x46cc60
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x46cc7d
mov eax, dword [ebp - 8]
mov edx, 0x46cd88
call fcn.00408af8
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46cc91
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ccb6
lea eax, [ebp - 0x10]
call fcn.00407a60
lea eax, [ebp - 4]
call fcn.00407a60
ret