joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4573d0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp ecx, 3
jne 0x45743d
mov eax, 0x208
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
lea edx, [ebp - 4]
push edx
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x457433
mov eax, dword [ebp + 0x18]
push 0
push 0
push 0
push 0
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push dword [ebp - 4]
test eax, eax
cmove edi, dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
cmp ecx, 4
jne 0x457449
mov eax, 0x108
jmp 0x4573eb
mov eax, 8
test ecx, ecx
je 0x4573eb
cmp ecx, 1
jne 0x45745e
mov ecx, SysReAllocString
jmp 0x4573f0
cmp ecx, 2
jne 0x45746a
mov ecx, SysReAllocString
jmp 0x4573f0
push str.Unhandled_eRegKeyRoot_passed_into_HKeyGet
push 0x184
push str.c:_buildslave_steam_rel_client_win32_build_srccommon_registry.cpp
call fcn.004767e0
add esp, 0xc
test al, al
jne 0x457486
int3
xor ecx, ecx
lea eax, [ecx + 8]
jmp 0x4573f0

Function at 0x457490
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp ecx, 3
jne 0x4574fe
mov eax, 0x201
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
lea edx, [ebp - 4]
push edx
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4574f4
mov eax, dword [ebp + 0x18]
push 0
push 0
push dword [ebp + 0x1c]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push dword [ebp - 4]
test eax, eax
cmove edi, dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp ecx, 4
jne 0x45750a
mov eax, 0x101
jmp 0x4574ab
mov eax, 1
test ecx, ecx
je 0x4574ab
cmp ecx, eax
jne 0x45751e
mov ecx, SysReAllocString
jmp 0x4574b0
cmp ecx, 2
jne 0x45752a
mov ecx, SysReAllocString
jmp 0x4574b0
push str.Unhandled_eRegKeyRoot_passed_into_HKeyGet
push 0x184
push str.c:_buildslave_steam_rel_client_win32_build_srccommon_registry.cpp
call fcn.004767e0
add esp, 0xc
test al, al
jne 0x457546
int3
xor ecx, ecx
lea eax, [ecx + 1]
jmp 0x4574b0
Function at 0x4577a0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
push esi
mov esi, dword [ebp + 0xc]
cmp eax, 3
jne 0x457805
mov ecx, 0x201
mov eax, reloc.OLEAUT32.dll_SysReAllocString
lea edx, [ebp - 4]
push edx
push ecx
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4577fb
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push eax
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 4
jne 0x457811
mov ecx, 0x101
jmp 0x4577bc
mov ecx, 1
test eax, eax
je 0x4577bc
cmp eax, ecx
jne 0x457825
mov eax, SysReAllocString
jmp 0x4577c1
cmp eax, 2
jne 0x457831
mov eax, SysReAllocString
jmp 0x4577c1
push str.Unhandled_eRegKeyRoot_passed_into_HKeyGet
push 0x184
push str.c:_buildslave_steam_rel_client_win32_build_srccommon_registry.cpp
call fcn.004767e0
add esp, 0xc
test al, al
jne 0x45784d
int3
xor eax, eax
lea ecx, [eax + 1]
jmp 0x4577c1

Function at 0x457860
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
cmp eax, 3
jne 0x4578da
mov ecx, 0x20219
mov eax, reloc.OLEAUT32.dll_SysReAllocString
lea edx, [ebp - 4]
push edx
push ecx
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
test edi, edi
jne 0x4578cf
push dword [ebp + 0x18]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push dword [ebp + 0x14]
push eax
push edi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
jne 0x4578c4
cmp dword [ebp + 8], 3
mov eax, 1
cmovne edi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret 0x14
cmp eax, 4
jne 0x4578e6
mov ecx, 0x20119
jmp 0x457880
mov ecx, 0x20019
test eax, eax
je 0x457880
cmp eax, 1
jne 0x4578fb
mov eax, SysReAllocString
jmp 0x457885
cmp eax, 2
jne 0x45790a
mov eax, SysReAllocString
jmp 0x457885
push str.Unhandled_eRegKeyRoot_passed_into_HKeyGet
push 0x184
push str.c:_buildslave_steam_rel_client_win32_build_srccommon_registry.cpp
call fcn.004767e0
add esp, 0xc
test al, al
jne 0x457926
int3
xor eax, eax
mov ecx, 0x20019
jmp 0x457885
Function at 0x457a00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
cmp eax, 3
jne 0x457a84
mov ecx, 0x20219
mov eax, reloc.OLEAUT32.dll_SysReAllocString
lea edx, [ebp - 4]
push edx
push ecx
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
test edi, edi
jne 0x457a79
mov dword [ebp + 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
lea eax, [ebp + 8]
mov dword [ebp - 8], 4
push eax
push edi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
jne 0x457a6e
cmp dword [ebp + 8], 4
mov eax, 1
cmovne edi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 4
jne 0x457a90
mov ecx, 0x20119
jmp 0x457a22
mov ecx, 0x20019
test eax, eax
je 0x457a22
cmp eax, 1
jne 0x457aa5
mov eax, SysReAllocString
jmp 0x457a27
cmp eax, 2
jne 0x457ab4
mov eax, SysReAllocString
jmp 0x457a27
push str.Unhandled_eRegKeyRoot_passed_into_HKeyGet
push 0x184
push str.c:_buildslave_steam_rel_client_win32_build_srccommon_registry.cpp
call fcn.004767e0
add esp, 0xc
test al, al
jne 0x457ad0
int3
xor eax, eax
mov ecx, 0x20019
jmp 0x457a27

Function at 0x457ae0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
push esi
mov esi, dword [ebp + 0xc]
cmp eax, 3
jne 0x457b47
mov ecx, 0x201
mov eax, reloc.OLEAUT32.dll_SysReAllocString
lea edx, [ebp - 4]
push edx
push ecx
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x457b3d
push eax
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
pop esi
mov esp, ebp
pop ebp
ret 0x14
cmp eax, 4
jne 0x457b53
mov ecx, 0x101
jmp 0x457afc
mov ecx, 1
test eax, eax
je 0x457afc
cmp eax, ecx
jne 0x457b67
mov eax, SysReAllocString
jmp 0x457b01
cmp eax, 2
jne 0x457b73
mov eax, SysReAllocString
jmp 0x457b01
push str.Unhandled_eRegKeyRoot_passed_into_HKeyGet
push 0x184
push str.c:_buildslave_steam_rel_client_win32_build_srccommon_registry.cpp
call fcn.004767e0
add esp, 0xc
test al, al
jne 0x457b8f
int3
xor eax, eax
lea ecx, [eax + 1]
jmp 0x457b01
Function at 0x457d00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
cmp eax, 3
jne 0x457d6d
mov ecx, 0x20206
mov eax, reloc.OLEAUT32.dll_SysReAllocString
push 0
lea edx, [ebp - 4]
push edx
push 0
push ecx
push 0
push 0
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edi, eax
test edi, edi
jne 0x457d62
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 3
push eax
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret 0x14
cmp eax, 4
jne 0x457d79
mov ecx, 0x20106
jmp 0x457d20
mov ecx, 0x20006
test eax, eax
je 0x457d20
cmp eax, 1
jne 0x457d8e
mov eax, SysReAllocString
jmp 0x457d25
cmp eax, 2
jne 0x457d9a
mov eax, SysReAllocString
jmp 0x457d25
push str.Unhandled_eRegKeyRoot_passed_into_HKeyGet
push 0x184
push str.c:_buildslave_steam_rel_client_win32_build_srccommon_registry.cpp
call fcn.004767e0
add esp, 0xc
test al, al
jne 0x457db6
int3
xor eax, eax
mov ecx, 0x20006
jmp 0x457d25

Function at 0x457ea0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp + 0x14], 0
push edi
mov edi, dword [ebp + 0xc]
cmp eax, 3
jne 0x457f13
mov ecx, 0x20206
mov eax, reloc.OLEAUT32.dll_SysReAllocString
push 0
lea edx, [ebp + 0x14]
push edx
push 0
push ecx
push 0
push 0
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edi, eax
test edi, edi
jne 0x457f08
push 4
lea eax, [ebp - 4]
push eax
push 4
push edi
push esi
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x14]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 4
jne 0x457f1f
mov ecx, 0x20106
jmp 0x457ec6
mov ecx, 0x20006
test eax, eax
je 0x457ec6
cmp eax, 1
jne 0x457f34
mov eax, SysReAllocString
jmp 0x457ecb
cmp eax, 2
jne 0x457f40
mov eax, SysReAllocString
jmp 0x457ecb
push str.Unhandled_eRegKeyRoot_passed_into_HKeyGet
push 0x184
push str.c:_buildslave_steam_rel_client_win32_build_srccommon_registry.cpp
call fcn.004767e0
add esp, 0xc
test al, al
jne 0x457f5c
int3
xor eax, eax
mov ecx, 0x20006
jmp 0x457ecb
Function at 0x457f70
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
sub esp, 0x114
mov ecx, dword [0x6aac10]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x62c070]
cmp eax, dword [ecx + 4]
jg 0x4580b8
mov eax, dword [0x62c06c]
test eax, eax
jne 0x457fab
mov eax, 1
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0
push ebx
push edi
push esi
call eax
test eax, eax
je 0x4580af
lea eax, [ebp - 8]
push eax
mov eax, ebx
or eax, 0x20019
push eax
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x457fef
xor ecx, ecx
cmp eax, 2
pop edi
pop esi
cmove eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x457ff4
sub ecx, edx
cmp byte [ecx + edi - 1], 0x5c
lea esi, [ecx + edi]
je 0x45800d
mov byte [esi], 0x5c
inc esi
mov byte [esi], al
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x104
push eax
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x45808e
jmp 0x458040
push 0x104
lea eax, [ebp - 0x114]
push eax
push esi
call fcn.00575600
push ebx
push edi
push dword [ebp + 8]
call fcn.00457f70
add esp, 0x18
test eax, eax
jne 0x45808e
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0x104
push eax
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x458040
mov byte [esi - 1], 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push ebx
push edi
push dword [ebp + 8]
call dword [0x62c06c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0x62c070
call fcn.0056b07e
add esp, 4
cmp dword [0x62c070], 0xffffffff
jne 0x457f99
push str.RegDeleteKeyExA
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x62c070
mov dword [0x62c06c], eax
call fcn.0056b034
add esp, 4
jmp 0x457f99
Function at 0x4595d0
Capabilities:
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58fab5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push esi
push edi
push 0
push 0
push 0
lea ecx, [ebp - 0x48]
xor bl, bl
call fcn.0046b0a0
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x48]
push 0
push 0
push eax
push ecx
mov eax, esp
mov dword [ebp - 4], 0
mov dword [eax], esi
call fcn.004715c0
add esp, 0x10
test al, al
je 0x459816
push 0
lea ecx, [ebp - 0x48]
call fcn.0046bc70
push 0
push 0
call fcn.00578b7c
add esp, 8
mov dword [ebp + 8], eax
test esi, esi
mov dword [ebp - 0x1c], 0
mov ecx, 0x592544
mov dword [ebp - 0x18], 0
cmovne ecx, esi
mov dword [ebp - 0x14], 0x4000000
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.00459840
push 0
push eax
push 0
call fcn.00575b34
add esp, 0xc
mov byte [ebp - 4], 0
cmp byte [ebp - 0x14], 0
mov edi, eax
je 0x459690
push dword [ebp - 0x20]
call fcn.0056acf4
add esp, 4
cmp byte [ebp - 0x13], 0
je 0x4596a1
push dword [ebp - 0x1c]
call fcn.0056acf4
add esp, 4
cmp byte [ebp - 0x12], 0
je 0x4596b2
push dword [ebp - 0x18]
call fcn.0056acf4
add esp, 4
cmp dword [ebp + 8], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0x4000000
je 0x459805
test edi, edi
je 0x459805
push 0x5c
push edi
call fcn.0056d107
add esp, 8
test eax, eax
je 0x459805
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor ecx, ecx
push edi
mov word [eax], cx
call esi
push edi
push str.INSTALLDIR
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov al, byte [ebp + 0x10]
mov ecx, 0x627078
mov word [0x627094], 0x3000
mov dword [0x62708c], 0
mov byte [0x627094], al
mov eax, dword [ebp + 0xc]
mov word [0x6270d5], 0
mov byte [0x6270d7], 0
mov dword [0x627090], 0
mov dword [0x627110], 0
mov dword [0x62710c], 0
mov dword [0x62708c], eax
call fcn.004587f0
mov eax, dword [0x62708c]
mov ecx, 0x627078
mov edx, dword [ebp - 0x44]
mov dword [0x627090], eax
mov eax, dword [ebp - 0x34]
add eax, edx
mov dword [0x6270f4], 0
mov dword [0x6270f8], 0
mov dword [0x6270e4], 0x627095
mov dword [0x6270e0], 0
mov dword [0x6270e8], 0
mov dword [0x6270ec], 0
mov dword [0x6270dc], 1
mov word [0x6270d8], 0
mov dword [0x6270f0], 0
mov byte [0x627095], 0
mov dword [0x62707c], edx
mov dword [0x627080], edx
mov dword [0x627084], eax
push 0
mov byte [0x627088], 0
call fcn.00458bf0
push dword [ebp + 8]
mov bl, al
call esi
push edi
call fcn.00575724
push dword [ebp + 8]
call fcn.00575724
add esp, 8
lea ecx, [ebp - 0x48]
call fcn.0046a080
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45e140
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58fe5d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
mov eax, dword [ebp + 0x18]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x14], 0x4000000
test eax, eax
mov dword [ebp - 0x1c], edi
mov ebx, 0x592544
mov dword [ebp - 0x18], edi
cmovne ebx, eax
mov dword [ebp - 0x20], ebx
cmp byte [0x62c3d0], 0
mov dword [ebp - 4], edi
je 0x45e1d4
push 4
push edi
push edi
push ebx
mov byte [ebp - 0x13], 1
call fcn.0046d410
xor ecx, ecx
mov esi, eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0056aceb
push 0
mov edi, eax
push esi
push edi
push ebx
mov dword [ebp - 0x1c], edi
call fcn.0046d410
add esp, 0x24
push 0x200030
push 0x5b0284
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call fcn.00579021
add esp, 4
mov dword [ebp - 0x10], eax
test edi, edi
jne 0x45e220
push 4
push edi
push edi
push ebx
mov byte [ebp - 0x13], 1
call fcn.0046d410
xor ecx, ecx
mov esi, eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0056aceb
push 0
mov edi, eax
push esi
push edi
push ebx
mov dword [ebp - 0x1c], edi
call fcn.0046d410
mov eax, dword [ebp - 0x10]
add esp, 0x24
push eax
push edi
call fcn.00579164
add esp, 8
test edi, edi
jne 0x45e266
push 4
push edi
push edi
push ebx
mov byte [ebp - 0x13], 1
call fcn.0046d410
xor ecx, ecx
mov esi, eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0056aceb
push 0
mov edi, eax
push esi
push edi
push ebx
mov dword [ebp - 0x1c], edi
call fcn.0046d410
add esp, 0x24
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [0x62c6e8], 0
je 0x45e322
push 0x62c6e8
lea eax, [ebp - 0x30]
push str._s_service_log.txt
push eax
call fcn.0046a380
add esp, 0xc
cmp byte [ebp - 0x21], 0
jge 0x45e2a4
mov eax, dword [ebp - 0x30]
test eax, eax
jne 0x45e2a7
mov eax, 0x592544
jmp 0x45e2a7
lea eax, [ebp - 0x30]
push fcn.00575cbf
push 0x5abc04
push eax
call fcn.00481c50
mov esi, eax
add esp, 0xc
test esi, esi
je 0x45e307
lea eax, [ebp - 0x40]
push 0x10
push eax
call fcn.00578f4e
lea eax, [ebp - 0x50]
push 0x10
push eax
call fcn.00578e95
push dword [ebp + 0x18]
cmp byte [ebp + 0x14], 0
mov ecx, 0x592544
mov eax, str.ERROR_
cmove eax, ecx
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x50]
push eax
push str._s__s_:__s_s
push esi
call fcn.00459f70
push esi
call fcn.00575d64
add esp, 0x2c
cmp byte [ebp - 0x21], 0
mov byte [ebp - 4], 1
jge 0x45e322
call fcn.0047f350
push 0
push dword [ebp - 0x30]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp byte [ebp - 0x13], 0
je 0x45e331
push edi
call fcn.0056acf4
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45e4d0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45e50c
test al, 3
je 0x45e4fc
and eax, 0xfffffffc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp eax, 1
sete al
test al, al
je 0x45e50c
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
pop esi
sete al
pop ebp
ret
xor al, al
pop esi
pop ebp
ret

Function at 0x45e520
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45e58a
test al, 3
je 0x45e54d
and eax, 0xfffffffc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp eax, 1
sete al
test al, al
je 0x45e58a
mov edi, dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45e575
test al, 3
je 0x45e575
and eax, 0xfffffffc
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp eax, 1
sete al
test al, al
je 0x45e58a
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp eax, 1
pop edi
sete al
pop esi
pop ebp
ret
pop edi
xor al, al
pop esi
pop ebp
ret
Function at 0x45e8a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58fee6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x628
push esi
push edi
push 0
mov dword [ebp - 0x1c], 1
mov esi, dword [ebp + 8]
mov ecx, esi
push 0
push 4
call fcn.00469fc0
mov dword [esi + 0x10], 0
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push str.SoftwareValveSteamService
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], 0
call edi
test eax, eax
je 0x45e940
call fcn.00475f40
test al, al
je 0x45ea94
lea eax, [ebp - 0x14]
push eax
push 0x20219
push 0
push str.SoftwareValveSteamService
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x45ea94
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x30a
push eax
lea eax, [ebp - 0x328]
mov edi, 1
push eax
push 0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x45ea8b
push ebx
lea eax, [ebp - 0x328]
push eax
push str.installpath_
call fcn.00469a30
add esp, 8
test eax, eax
jne 0x45ea5b
push 0x30a
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x328]
push eax
push dword [ebp - 0x14]
call fcn.004638f0
add esp, 0x10
test eax, eax
jne 0x45ea5b
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
lea eax, [ebp - 0x634]
push eax
call fcn.0046ad50
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 1
cmp eax, ecx
jb 0x45ea01
mov eax, dword [esi + 0x10]
lea eax, [ecx + eax*4]
lea ecx, [ebp - 0x10]
cmp ecx, eax
jae 0x45ea01
push str._src___m_Memory.Base______src____m_Memory.Base____m_Size___
push 0x487
push str.c:_buildslave_steam_rel_client_win32_build_srcpublic_tier1utlvector.h
call fcn.004767e0
add esp, 0xc
test al, al
jne 0x45ea01
int3
mov ebx, dword [esi + 0x10]
mov ecx, esi
call fcn.0046a330
mov ecx, dword [esi + 0x10]
inc ecx
cmp ecx, eax
jle 0x45ea28
mov ecx, esi
call fcn.0046a330
mov ecx, dword [esi + 0x10]
sub ecx, eax
inc ecx
push ecx
mov ecx, esi
call fcn.0046a1d0
mov eax, dword [esi + 4]
inc dword [esi + 0x10]
lea ecx, [eax + ebx*4]
mov eax, dword [ebp - 0x10]
mov dword [ecx], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 2
call fcn.0047f350
push 0
push dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
mov ecx, eax
call edx
mov byte [ebp - 4], 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x30a
push ecx
lea ecx, [ebp - 0x328]
mov eax, edi
push ecx
push eax
push dword [ebp - 0x14]
inc edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x45e973
pop ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret