joyce8/EMBER2024-capa huggingface dataset:
Function at 0xce9615
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], ecx
push eax
xor esi, esi
mov edi, 0xb4a448
push esi
push esi
push 2
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
cmp eax, 2
jne 0xce964c
xor eax, eax
jmp 0xce96db
test eax, eax
je 0xce9664
jg 0xce9659
mov esi, eax
jmp 0xce96d9
movzx esi, ax
or esi, 0x80070000
jmp 0xce96d9
push ebx
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
jne 0xce9683
mov esi, 0x8007000e
jmp 0xce96d8
lea eax, [ebp - 4]
push eax
push ebx
push esi
push 2
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov edi, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x6fc]
mov dword [eax + 0x6fc], esi
test ecx, ecx
je 0xce96bf
push ecx
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 8]
mov dword [eax + 0x6fc], ebx
test edi, edi
je 0xce96d8
jg 0xce96cf
mov esi, edi
jmp 0xce96d8
movzx esi, di
or esi, 0x80070000
pop ebx
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0xce96e3
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
push edi
mov esi, ecx
mov edi, 0x208
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x210], edi
push ecx
lea ecx, [ebp - 0x20c]
push ecx
push 0
push 2
push 0xb4a4c8
push eax
push edx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
je 0xce9739
push 2
push 0xb284a8
jmp 0xce9741
push edi
lea eax, [ebp - 0x20c]
push eax
lea eax, [esi + 0x4e8]
push edi
push eax
call dword [sym.imp.msvcrt.dll_memcpy_s]
mov ecx, dword [ebp - 4]
add esp, 0x10
neg eax
sbb eax, eax
xor ecx, ebp
pop edi
and eax, 0x8007007a
pop esi
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 8

Function at 0xce9838
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
push edi
mov esi, ecx
mov edi, 0x208
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x210], edi
push ecx
lea ecx, [ebp - 0x20c]
push ecx
push 0
push 2
push 0xb4a4a0
push eax
push edx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
je 0xce988e
push 2
push 0xb284a8
jmp 0xce9896
push edi
lea eax, [ebp - 0x20c]
push eax
lea eax, [esi + 0xd8]
push edi
push eax
call dword [sym.imp.msvcrt.dll_memcpy_s]
mov ecx, dword [ebp - 4]
add esp, 0x10
neg eax
sbb eax, eax
xor ecx, ebp
pop edi
and eax, 0x8007007a
pop esi
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 8
Function at 0xce98c2
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], ecx
push eax
xor esi, esi
mov edi, 0xb4a440
push esi
push esi
push 2
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
cmp eax, 2
jne 0xce98f9
xor eax, eax
jmp 0xce9988
test eax, eax
je 0xce9911
jg 0xce9906
mov esi, eax
jmp 0xce9986
movzx esi, ax
or esi, 0x80070000
jmp 0xce9986
push ebx
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
jne 0xce9930
mov esi, 0x8007000e
jmp 0xce9985
lea eax, [ebp - 4]
push eax
push ebx
push esi
push 2
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov edi, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x6f4]
mov dword [eax + 0x6f4], esi
test ecx, ecx
je 0xce996c
push ecx
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 8]
mov dword [eax + 0x6f4], ebx
test edi, edi
je 0xce9985
jg 0xce997c
mov esi, edi
jmp 0xce9985
movzx esi, di
or esi, 0x80070000
pop ebx
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0xce9990
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push esi
push 2
mov ebx, 0xb4a524
mov dword [ebp - 4], esi
push ebx
push dword [ebp + 0xc]
mov edi, ecx
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
cmp eax, 2
jne 0xce99c9
mov dword [edi + 0x700], esi
xor eax, eax
jmp 0xce9a19
test eax, eax
jne 0xce9a08
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [edi + 0x700], eax
test eax, eax
jne 0xce99ef
mov esi, 0x8007000e
jmp 0xce9a17
lea ecx, [ebp - 4]
push ecx
push eax
push esi
push 2
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
je 0xce9a17
jg 0xce9a0e
mov esi, eax
jmp 0xce9a17
movzx esi, ax
or esi, 0x80070000
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0xce9a22
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push esi
push 2
mov edi, 0xb4a438
mov dword [ebp - 4], esi
push edi
push dword [ebp + 0xc]
mov ebx, ecx
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
cmp eax, 2
jne 0xce9a5f
mov dword [ebx + 0x700], esi
xor eax, eax
jmp 0xce9ae1
test eax, eax
je 0xce9a6e
jg 0xce9a69
mov esi, eax
jmp 0xce9adf
movzx esi, ax
jmp 0xce9ad9
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 8], eax
test eax, eax
jne 0xce9a8d
mov esi, 0x8007000e
jmp 0xce9adf
lea ecx, [ebp - 4]
push ecx
push eax
push esi
push 2
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov edi, eax
mov eax, dword [ebx + 0x6f8]
mov dword [ebx + 0x6f8], esi
test eax, eax
je 0xce9ac3
push eax
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 8]
mov dword [ebx + 0x6f8], eax
test edi, edi
je 0xce9adf
jg 0xce9ad6
mov esi, edi
jmp 0xce9adf
movzx esi, di
or esi, 0x80070000
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0xce9d99
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x674
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x418]
mov dword [ebp - 0x624], ecx
push eax
mov ebx, edx
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
test eax, eax
jne 0xce9de4
mov ecx, dword [ebp + 4]
lea edx, [eax + 0xe]
push 0xb4aec8
call fcn.00c206ae
jmp 0xce9f58
push 0xb4af08
lea eax, [ebp - 0x418]
push eax
push 0x104
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchCombine]
mov esi, eax
test esi, esi
jns 0xce9e22
mov ecx, dword [ebp + 4]
mov edx, 0x10
push esi
push 0xb4aec8
call fcn.00bc2921
mov eax, esi
jmp 0xce9f58
lea ecx, [ebp - 0x210]
mov edi, 0xb4af38
mov eax, ecx
xor esi, esi
mov edx, 0x104
sub edi, eax
nop
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0xce9e59
movzx eax, word [edi + ecx]
test ax, ax
je 0xce9e59
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0xce9e39
jmp 0xce9e5d
test edx, edx
jne 0xce9e65
sub ecx, 2
mov esi, 0x8007007a
xor eax, eax
mov word [ecx], ax
test esi, esi
jns 0xce9e86
mov ecx, dword [ebp + 4]
lea edx, [eax + 0x12]
push esi
push 0xb4aec8
call fcn.00bc2921
mov eax, esi
jmp 0xce9f58
mov edi, dword [ebp - 0x624]
xor esi, esi
mov ecx, dword [esi + 0xb229e8]
mov eax, ecx
and eax, edi
cmp eax, ecx
jne 0xce9ee9
push 0xb3dfd4
mov edx, 0x104
lea ecx, [ebp - 0x210]
call fcn.00b80376
test eax, eax
jns 0xce9ebc
mov edx, 0x18
jmp 0xce9edb
push dword [esi + 0xb229ec]
mov edx, 0x104
lea ecx, [ebp - 0x210]
call fcn.00b80376
test eax, eax
jns 0xce9ee9
mov edx, 0x1a
mov ecx, dword [ebp + 4]
push eax
push 0xb4aec8
call fcn.00b913f8
add esi, 8
cmp esi, 0x28
jb 0xce9e8e
push 0x40
lea eax, [ebp - 0x66c]
mov dword [ebp - 0x670], 0x44
push 0
push eax
call fcn.00bc259b
add esp, 0xc
mov dword [ebp - 0x644], 0x20
lea eax, [ebp - 0x670]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
test eax, eax
jne 0xce9f56
mov ecx, dword [ebp + 4]
lea edx, [eax + 0x20]
push 0xb4aec8
call fcn.00c206ae
jmp 0xce9f58
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret

Function at 0xce9fa9
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0
je 0xce9fdd
lea eax, [ebp - 4]
push eax
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetExitCodeProcess]
test eax, eax
je 0xce9fdd
cmp dword [ebp - 4], 0x103
jne 0xce9fdd
push 0
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xcf67e8
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov ebx, edx
xor esi, esi
push edi
mov edi, ecx
mov dword [ebp - 0x24], esi
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x20], esi
mov dword [ebx], esi
mov dword [ebp - 0x1c], esi
call fcn.00b7a9bd
or dword [ebp - 0x20], 0xffffffff
lea edx, [ebp - 0x24]
or dword [ebp - 0x1c], 0xffffffff
mov ecx, edi
push esi
call fcn.00cab278
mov esi, eax
test esi, esi
js 0xcf68ec
mov ecx, dword [ebp - 0x24]
lea edx, [ebp - 8]
and dword [ebp - 8], 0
call fcn.00cf68fd
mov esi, eax
test esi, esi
js 0xcf68ec
lea ecx, [ebp - 0xc]
call fcn.00b5458d
mov eax, ecx
push eax
push ecx
mov ecx, dword [ebp - 8]
call fcn.00cf6931
mov esi, eax
test esi, esi
js 0xcf68db
lea ecx, [ebp - 4]
call fcn.00b5458d
mov eax, ecx
push eax
push 0x20019
push 0
push edi
push dword [ebp - 0xc]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jle 0xcf6889
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xcf68d3
push 4
pop edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], edi
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0xb4bb54
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jle 0xcf68be
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xcf68d3
cmp dword [ebp - 0x14], edi
jne 0xcf68ce
mov eax, dword [ebp - 0x18]
xor esi, esi
mov dword [ebx], eax
jmp 0xcf68d3
mov esi, 0x80004005
lea ecx, [ebp - 4]
call fcn.00c7301b
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_appmodel_state_l1_2_0.dll_CloseState]
lea ecx, [ebp - 0xc]
call fcn.00c7301b
lea ecx, [ebp - 0x24]
call fcn.00b7a9bd
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xcf6d97
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ecx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0xcf6dc1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0xcf6db9
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0xcf6dd4
mov eax, 0x80004005
ret
and al, 0x10
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x7fff0001
add eax, 0x8000ffff
ret
Function at 0xcf85cb
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
lea eax, [ebp - 0x54]
mov esi, 0xb28b08
mov edi, ebx
push 0x4e
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
push esi
push 0
push eax
call fcn.00bc259b
add esp, 0xc
mov dword [ebp - 0x58], esi
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0xffff
push 0xb4c694
push 0xb273d0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jle 0xcf8634
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0xcf8641
push ebx
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CLSIDFromString]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret

Function at 0xcf9353
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xb2c8c8
push 0xb4c8c0
push 0xb26910
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00b55e8f
mov esi, eax
add esp, 0x14
test esi, esi
jns 0xcf93aa
mov ecx, dword [ebp + 4]
mov edx, 0x18d
push esi
push 0xb4c894
call fcn.00bc2921
jmp 0xcf94c3
push edi
lea ecx, [ebp - 0x210]
call fcn.00b5458d
xor edi, edi
mov eax, ecx
push edi
push eax
push edi
push 2
push edi
push edi
push edi
lea eax, [ebp - 0x20c]
push eax
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
test eax, eax
je 0xcf93e2
mov edx, 0x199
jmp 0xcf94a3
mov ecx, dword [ebp - 0x210]
xor edx, edx
push 0xb2c870
push 0xb4c954
call fcn.00c44a23
mov esi, eax
test esi, esi
jns 0xcf9417
mov ecx, dword [ebp + 4]
mov edx, 0x19e
push esi
push 0xb4c894
call fcn.00bc2921
jmp 0xcf94b7
mov eax, dword [ebp + 8]
push 4
pop esi
push esi
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x214]
push eax
push esi
push 0xb4c834
push edi
push dword [ebp - 0x210]
call dword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegSetKeyValueW]
test eax, eax
je 0xcf9449
mov edx, 0x1a7
jmp 0xcf94a3
push esi
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0x10000000
push eax
push esi
push 0xb4c850
push edi
push dword [ebp - 0x210]
call dword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegSetKeyValueW]
test eax, eax
je 0xcf9479
mov edx, 0x1b0
jmp 0xcf94a3
push esi
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], edi
push eax
push esi
push 0xb4c870
push edi
push dword [ebp - 0x210]
call dword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegSetKeyValueW]
test eax, eax
je 0xcf94b5
mov edx, 0x1bc
mov ecx, dword [ebp + 4]
push eax
push 0xb4c894
call fcn.00ca90dc
mov esi, eax
jmp 0xcf94b7
mov esi, edi
lea ecx, [ebp - 0x210]
call fcn.00c7301b
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 8
Function at 0xcf94d6
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xb2c8c8
push 0xb4c8c0
push 0xb26910
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00b55e8f
mov esi, eax
add esp, 0x14
test esi, esi
jns 0xcf952c
mov edx, 0x179
mov ecx, dword [ebp + 4]
push esi
push 0xb4c894
call fcn.00bc2921
mov eax, esi
jmp 0xcf955e
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteKeyExW]
mov esi, eax
test esi, esi
jle 0xcf9553
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0xcf955c
mov edx, 0x17a
jmp 0xcf951a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret
Function at 0x418010
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x18
mov eax, dword [0x634038]
add byte [ebx + 0x63403c15], cl
add bh, al
inc esp
and al, 0x14
add byte [eax], al
add byte [eax], al
push esi
lea ecx, [eax + eax]
push edi
or ecx, edx
lea edx, [esp + 0x10]
mov dword [esp + 0x18], ecx
push edx
fild qword [esp + 0x1c]
push 0x20019
push 0
mov esi, 0x190
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
fadd qword [0x634050]
push SysFreeString
mov edi, esi
fstp qword [0x634050]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4180de
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0xc]
push ebp
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
mov ebp, 4
push str.Browse_For_Folder_Width
push eax
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], ebp
call ebx
test eax, eax
jne 0x4180a4
mov edi, dword [esp + 0x1c]
xor esi, esi
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push str.Browse_For_Folder_Height
push ecx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], ebp
call ebx
pop ebp
pop ebx
test eax, eax
jne 0x4180d3
or esi, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, edi
mov eax, esi
pop edi
pop esi
add esp, 0x18
ret

Function at 0x465ac0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov ebp, dword [ebx]
fistp dword [ebx - 0x35]
fcmovnb st(0), st(7)
leave
dec ebx
mov edx, 0x724b4bd4
jmp 0xf4d967d5
pop esp
mov dl, 0xb
adc al, 0x55
out 0x33, eax
sbb byte ss:[ecx + 0x6bcf6b7b], al
mov bh, 0x8a
fstp xword [ecx - 0x21556c1d]
push es
mov byte [0xdb317af1], bh
fmul dword [eax - 0xe]
xor bl, byte [esi]
and byte [eax], cl
push ebx
and eax, dword [ebx]
salc
jnp 0x465a85
rep outsb dx, byte [esi]
invalid

Function at 0x46a38c
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
xor al, 0x77
popal
pop eax
jne 0x46a38d
xchg edi, eax
xor edx, ecx
xchg esi, eax
imul ebx, dword [ebx + 0xb1fbff7], 0xffffffbb
jns 0x46a3f3
jb 0x46a3c4
stc
ljmp 0x9c29
fist dword [eax - 0x2a12b4a8]
imul edi, dword [ecx - 0x58], 0x81ea0258
dec ebx
in eax, dx
aad 0xf2
imul edi, dword [ecx - 0x58], 0x81ea0258
jns 0x46a439
invalid
loopne 0x46a455
mov bh, 0xab
xlatb
adc byte [ebx - 0x5f3a3de5], al
outsb dx, byte [esi]
mov dword [0xdba5bc72], eax
stc
loop 0x46a3c1
sbb al, byte [edi]
pop es
invalid
insd dword es:[edi], dx
push eax
sub ebp, dword [ecx + 0x592bcc]
fprem1
and ecx, dword [eax - 0x18]
in eax, 0xb3
sub edi, dword [edx + 0x69]
add ecx, 0x45
inc eax
insb byte es:[edi], dx
jnp 0x46a47d
fsubr qword [ebx]
add ch, bh
salc
int 0xca
adc cl, byte [edi]
adc edi, dword [ebx - 3]
push ds
sbb eax, 0x420c80e4
xor dword [edx], ebx
and dword [eax + 0x4aff7367], edi
push ss
jl 0x46a41e
in eax, dx
dec esi
sub cl, byte [ebx]
jmp 0x46a466
loope 0x46a408
mov eax, dword [esi]
or byte [esi + 0x74e7a592], 0x18
mov eax, 0x134f4b3b
and dword [ebp + 0x36], edx
call 0x8de273f6
in al, 0x4b
retf
invalid
Function at 0x46c8cc
Capabilities:
Encode data using xor

Disassembly:
push ds
and edi, edi
stosb byte es:[edi], al
out 0x38, al
jb 0x46c907
enter 0xffffffffffffea97, 0x6d
cmpsd dword [esi], dword es:[edi]
ficom dword [ecx]
int 0xb7
push ebx
stosb byte es:[edi], al
sbb eax, 0x580e966c
xchg ebx, eax
mov dh, 0xdd
dec esi
lahf
or eax, 0x17e9f11c
sub eax, 0x475245c9
adc byte [eax], bh
adc ebx, dword [ebx - 0x28e8b570]
xor eax, 0x8d9ad1e8
mov eax, dword [0x3d311d46]
dec esp
sbb byte [edx - 0xeec98ae], cl
aaa
cmp dh, al
lodsd eax, dword [esi]
lea ebx, [edi - 0x21c3acb8]
lcall 0x68f7, 0xd9963bab
jno 0x46c8d3
xlatb
aad 0x5f
pop esp
push ebx
or ch, bl
popfd
mov dword [0x19d81024], eax
lahf
call 0x8c58abd
adc dl, byte [ebx + 0x39e6181]
test al, 0x81
adc eax, 0x18b469b3
cmpsb byte [esi], byte es:[edi]
sar dword [esi + 8], 0x12
xchg ebx, eax
and dword [ecx - 0x62], 0x1581a803
mov bl, 0x69
mov ah, 0x18
adc dword [0x18b469b3], 0x88948970
cmc
jo 0x46c8af
xchg esp, eax
mov ch, dh
push ss
sub ecx, ecx
les esp, [esi]
push ss
mov al, byte [0x3ddcf8e0]
cmp eax, 0xe6066423
out 0x4a, al
lahf
sbb byte [ecx + 0x11], ch
imul esi, ecx, 0xffffff99
mov dword [esi], 0x4064ebe4
loope 0x46c91e
inc esp
cmp di, word [ebx + ecx*2]
sub edx, ecx
clc
push eax
or ch, byte [eax + 0x250b3a19]
test al, 0x19
cmp cl, byte [ebx]
and eax, 0xecc01c3b
test dword [ebx + 0x2d], ebp
add byte [eax - 0xf], bh
push esp
push cs
leave
cli
cwde
scasd eax, dword es:[edi]
jns 0x46c99c
jne 0x46c913
lcall 0xe70b, 0x38fc4474
inc ebp
invalid
sti
loop 0x46c9b0
invalid
sub dword [eax + 0x51], esi
lcall 0xe72a, 0x589ba513
sar dword [edx - 0x28], 1
cmp ch, cl
outsd dx, dword [esi]
xchg ebx, eax
movsd dword es:[edi], dword [esi]
or dword [0xe31d580a], edx
xchg edi, eax
loope 0x46c9ca
inc ecx
push ss
invalid
rcl dword [esi], 0x8c
mov bl, 0x84
aaa
lodsd eax, dword [esi]
inc edi
xor byte [ecx - 0x6e08f4df], dl
invalid

Function at 0x57cd69
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x10f3ec2a
jge 0x57cdc0
inc ecx
pop ds
or dword [ebp + 0x50], edi
fsubr st(4), st(0)
jae 0x57cdb4
cmp eax, 0x64af6e03
add al, 0x4b
push 0x64
mov ch, byte [eax - 0x26]
stosd dword es:[edi], eax
fisttp word [ecx - 0x450775be]
sbb esp, eax
movsb byte es:[edi], byte [esi]
sahf
sbb ecx, 0x71
imul esp, dword [ecx], 0x14
imul edx, dword [ebp - 0x2a765750], 0xdb34e5e0
xor eax, 0x49afe264
les ebx, [ebx - 0x248b586c]
sub dword [esi], 0x67
pop ss
stc
salc
cmovle esp, dword [esi + 0x77]
sub dword [ebx + 0x4ee10dfc], esp
dec esi
ja 0x57cde1
mov dword [0x4ee10dfc], eax
xor dh, dl
jo 0x57cd81
ror dl, 0xc5
and ecx, dword [edx]
lahf
mov eax, 0x2b7220b0
push eax
test byte [0x3ba6973d], dl
sbb dword [esi + ebp*2 - 0x6e], ebx
mov eax, 0x26290f73
cmpsb byte [esi], byte es:[edi]
std
aas
invalid
retf 0x23c5
imul edx, dword [ebp + 0x49], 0x6869d7a9
jmp 0x57ce18
push es
invalid
Function at 0x62b085
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x634428
cmp edx, dword [eax]
je 0x62b0a7
add eax, 8
inc ecx
cmp eax, 0x6344b8
jl 0x62b098
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x634428]
jne 0x62b1d5
mov eax, dword [0x638db0]
cmp eax, 1
je 0x62b1af
test eax, eax
jne 0x62b0d8
cmp dword [0x634350], 1
je 0x62b1af
cmp edx, 0xfc
je 0x62b1d5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x62b10f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0062ba70
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0062bf00
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x62b152
lea eax, [ebp - 0x1a4]
push eax
call fcn.0062bf00
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x630c04
push edi
call fcn.0062ddd0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0062ba70
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0062ba80
lea eax, [ebp - 0xa0]
push 0x630be4
push eax
call fcn.0062ba80
push dword [esi + 0x63442c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0062ba80
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062dd44
add esp, 0x2c
pop edi
jmp 0x62b1d5
lea eax, [ebp + 8]
lea esi, [esi + 0x63442c]
push 0
push eax
push dword [esi]
call fcn.0062bf00
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret