joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449c4c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.0040a944
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x449cb6
test ah, 4
je 0x449caf
test bl, bl
jne 0x449c74
mov al, 1
jmp 0x449cdd
test al, 0x10
je 0x449c7c
xor eax, eax
jmp 0x449cdd
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push edi
call sub.kernel32.dll_CreateFileW_1
cmp eax, 0xffffffff
je 0x449ca0
push eax
call sub.kernel32.dll_CloseHandle_1
mov al, 1
jmp 0x449cdd
call sub.kernel32.dll_GetLastError_2
mov ebx, eax
cmp ebx, 0x20
sete al
jmp 0x449cdd
test al, 0x10
sete al
jmp 0x449cdd
call sub.kernel32.dll_GetLastError_2
mov ebx, eax
cmp ebx, 2
je 0x449cd7
cmp ebx, 3
je 0x449cd7
cmp ebx, 0x7b
je 0x449cd7
mov eax, esi
call fcn.00449c0c
test al, al
jne 0x449cdb
xor eax, eax
jmp 0x449cdd
mov al, 1
pop edi
pop esi
pop ebx
ret

Function at 0x449ce4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov byte [esp], dl
mov edi, eax
xor ebx, ebx
mov eax, edi
call fcn.0040a944
mov ebp, eax
push ebp
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x449d8b
test esi, 0x400
jne 0x449d20
test esi, 0x10
setne bl
jmp 0x449dbb
cmp byte [esp], 0
je 0x449d54
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80000000
push ebp
call sub.kernel32.dll_CreateFileW_1
cmp eax, 0xffffffff
je 0x449dbb
push eax
call sub.kernel32.dll_CloseHandle_1
test esi, 0x10
setne bl
jmp 0x449dbb
test esi, 0x10
je 0x449d60
mov bl, 1
jmp 0x449dbb
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80000000
push ebp
call sub.kernel32.dll_CreateFileW_1
cmp eax, 0xffffffff
je 0x449d87
push eax
call sub.kernel32.dll_CloseHandle_1
xor ebx, ebx
jmp 0x449dbb
mov bl, 1
jmp 0x449dbb
call sub.kernel32.dll_GetLastError_2
cmp eax, 2
je 0x449db5
cmp eax, 3
je 0x449db5
cmp eax, 0xa1
je 0x449db5
cmp eax, 0x7b
je 0x449db5
cmp eax, 0x35
je 0x449db5
cmp eax, 0x15
je 0x449db5
cmp eax, 0x43
jne 0x449db9
xor ebx, ebx
jmp 0x449dbb
mov bl, 1
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x449dc4
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x449e69
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040a944
push eax
call sub.kernel32.dll_GetFileAttributesW
mov edi, eax
test edi, 0x400
setne al
test al, bl
je 0x449e4e
or edi, 0xffffffff
lea edx, [ebp - 4]
mov eax, esi
call fcn.004481a0
test al, al
je 0x449e4e
mov eax, dword [ebp - 4]
call fcn.0044a448
test al, al
je 0x449e3e
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.0044a220
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00450884
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
call fcn.0040abb0
mov eax, dword [ebp - 4]
call fcn.0040a944
push eax
call sub.kernel32.dll_GetFileAttributesW
mov edi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449e70
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00409974
ret
Function at 0x449e7c
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov byte [ebp - 9], cl
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x449f4f
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409d3c
cmp byte [ebp - 9], 0
je 0x449f0d
mov eax, ebx
call fcn.0040a944
push eax
call sub.kernel32.dll_GetFileAttributesW
test ah, 4
je 0x449f0d
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004481a0
test al, al
je 0x449f0d
mov eax, dword [ebp - 8]
call fcn.0044a448
test al, al
je 0x449f02
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0044a220
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00450884
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
call fcn.0040abb0
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00409d3c
push edi
mov eax, dword [ebp - 4]
call fcn.0040a944
push eax
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
jne 0x449f27
call sub.kernel32.dll_GetLastError_2
mov esi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449f56
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00409974
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409974
ret

Function at 0x44a08c
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, eax
mov eax, esi
call fcn.0040a944
mov ebp, eax
push ebp
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x44a0e1
call sub.kernel32.dll_GetLastError_2
mov edi, eax
push ebp
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x44a0db
test ah, 4
je 0x44a0db
test al, 0x10
je 0x44a0db
mov eax, esi
call fcn.0040a944
push eax
call sub.kernel32.dll_RemoveDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x44a0e1
push edi
call sub.kernel32.dll_SetLastError
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x44e5bc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x44e5f5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00409a9c
jmp 0x44e5fe
mov eax, ebx
mov edx, esi
call fcn.00409cf4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x44e608
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x44e62a
movzx eax, word [esp]
jmp 0x44e62c
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x44f5cc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x44f6f1
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.0044f3d4
mov esi, eax
mov eax, dword [0x768dc4]
cmp byte [eax], 0
je 0x44f699
mov eax, dword [0x768a0c]
call fcn.004070f0
call fcn.004068bc
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x44f59c]
call fcn.0040bea4
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x44f70c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x44f6d5
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x768968]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x76bc54]
call fcn.0040c0b0
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f6f8
lea eax, [ebp - 4]
mov edx, dword [0x44f59c]
call fcn.0040bfc8
ret

Function at 0x450394
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45046a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409d3c
lea eax, [ebp - 4]
call fcn.00409ef0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a944
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x450454
mov eax, ebx
call fcn.00406718
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x45044d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a944
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x450437
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x45047c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x450437
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450454
mov eax, dword [ebp - 0x10]
call fcn.00406734
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450471
lea eax, [ebp - 4]
call fcn.00409914
ret
Function at 0x451810
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff800
mov esi, edx
mov edi, eax
mov eax, esi
call fcn.00409914
push 0x400
lea eax, [esp + 4]
push eax
mov eax, edi
call fcn.0040a944
mov ebp, eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableW
mov ebx, eax
cmp ebx, 0x400
jge 0x451855
mov edx, esp
mov eax, esi
mov ecx, ebx
call fcn.00409a9c
jmp 0x45186e
mov edx, ebx
dec edx
mov eax, esi
call fcn.0040aad8
push ebx
mov eax, dword [esi]
call fcn.0040a944
push eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableW
add esp, 0x800
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x45f070
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x220], edx
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x210], edx
mov dword [ebp - 0x214], edx
mov dword [ebp - 0x218], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45f2de
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x45f1ac
lea eax, [ebp - 0x20a]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
test eax, eax
jbe 0x45f0f6
mov eax, ebx
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.0040aa00
jmp 0x45f0fd
mov eax, ebx
call fcn.00409914
cmp dword [ebx], 0
jne 0x45f110
mov ecx, ebx
xor edx, edx
mov eax, 0x1a
call fcn.004613c0
cmp dword [ebx], 0
je 0x45f29a
push 0
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_CreateDirectoryW
mov eax, dword [ebx]
call fcn.00409e0c
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x45f144
mov eax, ebx
mov edx, 0x45f2f8
call fcn.0040ab58
push dword [ebx]
lea edx, [ebp - 0x218]
xor eax, eax
call fcn.0045edb8
mov eax, dword [ebp - 0x218]
lea edx, [ebp - 0x214]
call fcn.004162cc
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x210]
call fcn.0045ee6c
push dword [ebp - 0x210]
push 0x45f308
mov eax, ebx
mov edx, 3
call fcn.0040ac38
push 0
mov eax, dword [ebx]
call fcn.0040a944
push eax
call sub.kernel32.dll_CreateDirectoryW
mov eax, ebx
mov edx, 0x45f2f8
call fcn.0040ab58
jmp 0x45f29a
lea eax, [ebp - 0x20a]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
test eax, eax
jbe 0x45f293
lea eax, [ebp - 0x21c]
lea esi, [ebp - 0x20a]
mov edx, esi
mov ecx, 0
call fcn.0040a0a0
mov edx, dword [ebp - 0x21c]
mov eax, ebx
call fcn.0040aa1c
cmp dword [ebx], 0
je 0x45f29a
push 0
push esi
call sub.kernel32.dll_CreateDirectoryA
mov eax, dword [ebx]
call fcn.00409e0c
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x45f218
mov eax, ebx
mov edx, 0x45f2f8
call fcn.0040ab58
push dword [ebx]
lea edx, [ebp - 0x228]
xor eax, eax
call fcn.0045edb8
mov eax, dword [ebp - 0x228]
lea edx, [ebp - 0x224]
call fcn.004162cc
mov eax, dword [ebp - 0x224]
lea edx, [ebp - 0x220]
call fcn.0045ee6c
push dword [ebp - 0x220]
push 0x45f308
mov eax, ebx
mov edx, 3
call fcn.0040ac38
push 0
lea eax, [ebp - 0x22c]
mov edx, dword [ebx]
mov ecx, 0
call fcn.0040a554
mov eax, dword [ebp - 0x22c]
call fcn.0040a3a8
push eax
call sub.kernel32.dll_CreateDirectoryA
mov eax, ebx
mov edx, 0x45f2f8
call fcn.0040ab58
jmp 0x45f29a
mov eax, ebx
call fcn.00409914
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f2e5
lea eax, [ebp - 0x22c]
call fcn.00409938
lea eax, [ebp - 0x228]
mov edx, 3
call fcn.00409974
lea eax, [ebp - 0x21c]
call fcn.00409938
lea eax, [ebp - 0x218]
mov edx, 3
call fcn.00409974
ret
Function at 0x45f320
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd8c
push ebx
xor eax, eax
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x264], eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45f56f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0045f070
cmp dword [ebp - 4], 0
je 0x45f539
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x45f43d
mov eax, dword [ebp - 4]
call fcn.0040a944
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x45f539
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x258]
mov ecx, 0x45f588
mov edx, dword [ebp - 4]
call fcn.0040abb0
mov eax, dword [ebp - 0x258]
call fcn.0040a944
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x45f42a
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x228]
mov ecx, 0x104
call fcn.0040aa00
mov ecx, dword [ebp - 0x260]
lea eax, [ebp - 0x25c]
mov edx, dword [ebp - 4]
call fcn.0040abb0
mov eax, dword [ebp - 0x25c]
call fcn.0040a944
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x254]
push eax
push ebx
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x45f3d8
push ebx
call sub.kernel32.dll_FindClose_1
mov eax, dword [ebp - 4]
call fcn.0040a944
push eax
call sub.kernel32.dll_RemoveDirectoryW
jmp 0x45f539
lea eax, [ebp - 0x264]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.0040a554
mov eax, dword [ebp - 0x264]
call fcn.0040a3a8
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x45f539
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x268]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.0040a554
lea eax, [ebp - 0x268]
mov edx, 0x45f59c
call fcn.0040a184
mov eax, dword [ebp - 0x268]
call fcn.0040a3a8
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x45f515
lea eax, [ebp - 0x26c]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.0040a554
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x270]
lea edx, [ebp - 0x254]
add edx, 0x2c
mov ecx, 0x104
push 0
call fcn.0040a128
mov edx, dword [ebp - 0x270]
pop eax
call fcn.0040a184
mov eax, dword [ebp - 0x26c]
call fcn.0040a3a8
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x254]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x45f4ac
push ebx
call sub.kernel32.dll_FindClose_1
lea eax, [ebp - 0x274]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.0040a554
mov eax, dword [ebp - 0x274]
call fcn.0040a3a8
push eax
call sub.kernel32.dll_RemoveDirectoryA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f576
lea eax, [ebp - 0x274]
mov edx, 5
call fcn.004099a4
lea eax, [ebp - 0x260]
mov edx, 3
call fcn.00409974
lea eax, [ebp - 4]
call fcn.00409914
ret
Function at 0x45f5a0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
xor edx, edx
mov dword [ebp - 0x214], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45f645
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x104
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x45f5f9
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20e]
push eax
call sub.kernel32.dll_GetComputerNameW
mov eax, ebx
lea edx, [ebp - 0x20e]
mov ecx, 0x105
call fcn.0040aa00
jmp 0x45f62c
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20e]
push eax
call sub.kernel32.dll_GetComputerNameA
lea eax, [ebp - 0x214]
lea edx, [ebp - 0x20e]
mov ecx, 0
call fcn.0040a0a0
mov edx, dword [ebp - 0x214]
mov eax, ebx
call fcn.0040aa1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f64c
lea eax, [ebp - 0x214]
call fcn.00409938
ret
Function at 0x45f654
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x45f80f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00409914
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x45f730
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, edi
call fcn.0040a944
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x45f7f4
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040a944
mov edi, eax
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x45f722
cmp dword [ebp - 0xc], 0
je 0x45f722
mov eax, dword [ebp - 0xc]
add eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x45f71c
mov eax, ebx
mov edx, esi
call fcn.0040a9ac
push esi
call sub.kernel32.dll_LocalFree_1
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x45f7f4
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x14]
mov edx, edi
mov ecx, 0
call fcn.0040a554
mov eax, dword [ebp - 0x14]
call fcn.0040a3a8
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x45f7f4
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.0040a554
mov eax, dword [ebp - 0x18]
call fcn.0040a3a8
mov edi, eax
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x45f7eb
cmp dword [ebp - 0xc], 0
je 0x45f7eb
mov eax, dword [ebp - 0xc]
add eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x45f7e5
lea eax, [ebp - 0x1c]
mov edx, esi
mov ecx, 0
call fcn.0040a0a0
mov edx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.0040aa1c
push esi
call sub.kernel32.dll_LocalFree_1
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f816
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004099a4
ret
Function at 0x45f820
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x45f973
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x45f8c2
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, edi
call fcn.0040a944
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExW
test eax, eax
jne 0x45f950
mov eax, dword [ebp + 8]
call fcn.00409e0c
add eax, eax
add eax, 2
push eax
mov eax, dword [ebp + 8]
call fcn.0040a944
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.0040a944
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x45f950
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x14]
mov edx, edi
mov ecx, 0
call fcn.0040a554
mov eax, dword [ebp - 0x14]
call fcn.0040a3a8
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x45f950
lea eax, [ebp - 4]
mov edx, dword [ebp + 8]
mov ecx, 0
call fcn.0040a554
mov eax, dword [ebp - 4]
call fcn.00409e24
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.0040a3a8
push eax
push 1
push 0
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
mov ecx, 0
call fcn.0040a554
mov eax, dword [ebp - 0x18]
call fcn.0040a3a8
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f97a
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004099a4
lea eax, [ebp - 4]
call fcn.00409938
ret
Function at 0x45f988
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x45fa73
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x45f9fb
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov eax, edi
call fcn.0040a944
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x45fa58
mov eax, dword [ebp - 4]
call fcn.0040a944
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x45fa58
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0xc]
mov edx, edi
mov ecx, 0
call fcn.0040a554
mov eax, dword [ebp - 0xc]
call fcn.0040a3a8
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x45fa58
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.0040a554
mov eax, dword [ebp - 0x10]
call fcn.0040a3a8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45fa7a
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004099a4
ret

Function at 0x460140
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0041aab4
test eax, eax
je 0x4601f1
cmp word [eax + 0x18], 0x20b
jne 0x46017e
add eax, 0x18
add eax, 0x78
mov edx, dword [eax]
mov esi, edx
add esi, dword [ebp - 4]
add edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
jmp 0x460190
add eax, 0x80
mov edx, dword [eax]
mov esi, edx
add esi, dword [ebp - 4]
add edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
test esi, esi
je 0x4601f1
jmp 0x4601eb
mov eax, dword [esi + 0x10]
cmp eax, dword [ebp - 0x10]
jbe 0x4601a7
push ebp
call fcn.0045ff80
pop ecx
jmp 0x4601f1
cmp dword [esi + 0x10], 0
je 0x4601e8
mov ebx, dword [ebp - 4]
add ebx, dword [esi + 0x10]
jmp 0x4601e3
cmp edi, dword [ebx]
jne 0x4601e0
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4601e0
mov eax, dword [ebp - 8]
mov dword [ebx], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
add ebx, 4
cmp dword [ebx], 0
jne 0x4601b5
add esi, 0x14
cmp dword [esi + 0xc], 0
jne 0x460196
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret