joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45cda4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xffffffec
mov ebx, eax
push esp
call sub.USER32.DLL_GetCursorPos
push esp
push dword [ebx]
call sub.USER32.DLL_ScreenToClient
mov eax, esp
push eax
push 0
push 0x1012
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push 0x10
call sub.USER32.DLL_GetKeyState
test ah, 0x80
setne bl
and ebx, 1
push 0x12
call sub.USER32.DLL_GetKeyState
test ah, 0x80
setne al
and eax, 1
push 0x11
mov esi, eax
call sub.USER32.DLL_GetKeyState
test ah, 0x80
setne al
and eax, 1
test byte [esp + 8], 1
jne 0x45ce0f
test ebx, ebx
jne 0x45ce0f
test esi, esi
jne 0x45ce0f
test eax, eax
je 0x45ce13
xor edx, edx
jmp 0x45ce18
mov edx, 1
mov eax, edx
add esp, 0x14
pop esi
pop ebx
ret

Function at 0x45ce20
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffa78
mov ebx, eax
push 0
push 0
push 0x1004
push dword [ebx]
call sub.USER32.DLL_SendMessageA
mov esi, eax
mov eax, esp
mov edx, 0x400
call fcn.00463dbc
push 0x4001
push 0x160
lea ecx, [esp + 0x408]
push ecx
push 0
lea eax, [esp + 0x10]
push eax
call sub.SHELL32.DLL_SHGetFileInfoA
push 0x28
push 0
lea edx, [esp + 0x568]
push edx
call fcn.00497b00
add esp, 0xc
xor eax, eax
mov dword [esp + 0x560], 3
mov ecx, dword [esp + 0x404]
mov dword [esp + 0x57c], ecx
mov dword [esp + 0x564], esi
mov dword [esp + 0x568], eax
mov eax, 0x3d4
call fcn.004125d0
mov dword [esp + 0x574], eax
lea edx, [esp + 0x560]
push edx
push 0
push 0x1007
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push dword [ebx]
call sub.USER32.DLL_SetFocus
mov byte [ebx + 0x1c], 1
push 0
push esi
push 0x1017
push dword [ebx]
call sub.USER32.DLL_SendMessageA
add esp, 0x588
pop esi
pop ebx
ret
Function at 0x45d248
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff178
mov ebx, eax
cmp dword [0x4c7804], 0
je 0x45d264
mov edx, 0x4a902a
jmp 0x45d269
mov edx, 0x4a9032
mov eax, 0x4a8e43
xor ecx, ecx
call fcn.0046139c
mov edi, eax
mov eax, edi
and eax, 0x1f
cmp eax, 2
jne 0x45d3a8
xor esi, esi
mov dword [esp + 8], esi
xor eax, eax
mov dword [esp + 0xc], eax
lea edx, [esp + 4]
mov dword [esp + 4], 4
push edx
push 0
push 0x1005
push dword [ebx]
call sub.USER32.DLL_SendMessageA
test eax, eax
je 0x45d3a8
mov eax, 0x4c9844
mov edx, dword [esp + 0x24]
call fcn.00460bd0
mov ebp, esi
mov dword [eax + 8], ebp
mov eax, dword [0x4c7804]
test eax, eax
jne 0x45d3a2
mov byte [esp + 0x2c], 0
add eax, 2
lea edx, [esp + 0x2c]
mov dword [esp + 0x84], eax
lea ecx, [esp + 0x7c]
mov dword [esp + 0x94], 0x50
mov dword [esp + 0x90], edx
push ecx
push ebp
push 0x102d
push dword [ebx]
call sub.USER32.DLL_SendMessageA
cmp byte [esp + 0x2c], 0
jne 0x45d3a2
lea ecx, [esp + 0xa4]
mov eax, 0x4c9844
mov edx, dword [esp + 0x24]
call fcn.00460a14
push 0x400
push 0x160
lea eax, [esp + 0xcdc]
push eax
push 0
lea edx, [esp + 0xb4]
push edx
call sub.SHELL32.DLL_SHGetFileInfoA
test eax, eax
je 0x45d3a2
cmp byte [esp + 0xde4], 0
jne 0x45d36f
lea ecx, [esp + 0xde4]
lea edx, [esp + 0xa4]
mov eax, ebx
call fcn.0045cf24
mov ecx, dword [0x4c7804]
lea eax, [esp + 0xde4]
add ecx, 2
lea edx, [esp + 0xe34]
mov dword [esp + 0xe3c], ecx
mov dword [esp + 0xe48], eax
push edx
push ebp
push 0x102e
push dword [ebx]
call sub.USER32.DLL_SendMessageA
inc esi
jmp 0x45d287
mov edx, 0x4a905d
mov eax, 0x4a8e43
mov ecx, 1
call fcn.0046139c
test eax, eax
je 0x45d3c3
or edi, 0x40
mov edx, 0x4a8e5f
mov eax, 0x4a8e43
xor ecx, ecx
call fcn.0046139c
test eax, eax
je 0x45d3de
or edi, 0x80
push 0x45819b
push edi
push 0x1030
push dword [ebx]
call sub.USER32.DLL_SendMessageA
cmp dword [ebx + 4], 0
je 0x45d4f7
test edi, 0x20
setne al
and eax, 1
and edi, 0x1f
or ebp, 0xffffffff
mov byte [esp], al
xor eax, eax
mov edx, eax
shl edx, 3
sub edx, eax
cmp edi, dword [edx*4 + 0x4a8cd0]
jne 0x45d42a
mov ebp, dword [edx*4 + 0x4a8ccc]
jmp 0x45d430
inc eax
cmp eax, 7
jl 0x45d411
push 0
push ebp
push 0x108c
push dword [ebx]
call sub.USER32.DLL_SendMessageA
mov dword [esp + 0xe5c], 0x24
xor esi, esi
lea eax, [esp + 0xe5c]
push eax
mov edi, esi
push edi
push 0x1203
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
test eax, eax
je 0x45d49b
test byte [esp + 0xe71], 8
je 0x45d495
and dword [esp + 0xe70], 0xffffe7ff
lea eax, [esp + 0xe5c]
push eax
push edi
push 0x1204
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
jmp 0x45d49b
inc esi
cmp esi, 0x10
jl 0x45d44c
push dword [ebx + 0xc]
push 0
push 0x1208
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
lea edx, [esp + 0xe5c]
push edx
push ebp
push 0x1203
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
or dword [esp + 0xe70], 0x1800
mov ecx, 1
cmp byte [esp], 0
jne 0x45d4da
dec ecx
mov dword [esp + 0xe78], ecx
lea eax, [esp + 0xe5c]
push eax
push ebp
push 0x1204
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
add esp, 0xe88
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x45e1b0
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffff800
mov ebx, eax
mov eax, ebx
call fcn.0045e68c
cmp dword [0x4c7804], 0
je 0x45e27b
push esp
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov eax, esp
call fcn.0040c208
mov esi, eax
cmp esi, 0xffffffff
je 0x45e22a
call fcn.00463e48
mov ecx, esi
mov edx, 1
shl edx, cl
and eax, edx
jne 0x45e22a
lea edx, [esp + 0x400]
mov eax, 0x4c5bc4
xor ecx, ecx
call fcn.00457598
lea eax, [esp + 0x400]
call fcn.0040c2fc
lea edx, [esp + 0x400]
push edx
call fcn.00499610
pop ecx
xor eax, eax
jmp 0x45e27d
mov eax, dword [0x4c4e68]
test eax, eax
je 0x45e239
push eax
call sub.USER32.DLL_DestroyWindow
mov eax, ebx
call fcn.0045e11c
xor edx, edx
mov eax, ebx
mov dword [0x4c7804], edx
call fcn.0045db34
mov eax, ebx
call fcn.0045e308
mov byte [0x4c5414], 0
mov eax, 0x4c53e8
call fcn.0047c924
mov eax, 0x4c53a0
call fcn.0045e824
mov eax, 0x4c53a0
call fcn.0045e9a8
mov al, 1
add esp, 0x800
pop esi
pop ebx
ret

Function at 0x45ee44
Capabilities:
Get disk information
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffaa0
mov esi, eax
mov dword [esi], edx
push 0x4001
push 0x160
lea eax, [esp + 8]
push eax
push 0
push 0x4a9360
call sub.SHELL32.DLL_SHGetFileInfoA
mov ebx, eax
test ebx, ebx
jne 0x45eea3
lea eax, [esp + 0x160]
push eax
push 0x400
call sub.KERNEL32.DLL_GetLogicalDriveStringsA
push 0x4001
push 0x160
lea edx, [esp + 8]
push edx
push 0
lea ecx, [esp + 0x170]
push ecx
call sub.SHELL32.DLL_SHGetFileInfoA
mov ebx, eax
push ebx
push 0
push 0x1109
push dword [esi]
call sub.USER32.DLL_SendMessageA
add esp, 0x560
pop esi
pop ebx
ret
Function at 0x460144
Capabilities:
Get file system object information

Disassembly:
add esp, 0xfffffea0
push ecx
push 0x160
lea eax, [esp + 8]
push eax
push 0
push edx
call sub.SHELL32.DLL_SHGetFileInfoA
mov eax, dword [esp + 4]
add esp, 0x160
ret
Function at 0x46082c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x28], eax
mov eax, 0x4a94b0
call fcn.004980b0
mov word [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
mov edx, 1
add eax, 0xf8
call fcn.00460964
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
imul edx, dword [eax + 0x104], 0x38
mov esi, dword [ecx + 0xf8]
add esi, edx
cmp word [ebx + 0x400], 0
je 0x460883
lea ecx, [ebx + 0x400]
jmp 0x460885
xor ecx, ecx
mov edx, ebx
mov eax, dword [ebp - 0x28]
call fcn.0040fbfc
mov word [ebp - 0x14], 0
jmp 0x4608d5
mov edx, dword [ebx + 0xc2c]
mov dword [esi + 8], edx
mov ecx, dword [ebx + 0xc00]
mov dword [esi + 0xc], ecx
mov ecx, dword [ebx + 0xc04]
mov dword [esi + 0x10], ecx
mov eax, dword [ebx + 0xc08]
mov dword [esi + 0x14], eax
mov eax, dword [ebx + 0xc0c]
mov dword [esi + 0x18], eax
mov edx, dword [ebx + 0xc10]
mov dword [esi + 0x1c], edx
mov ecx, dword [ebx + 0xc14]
mov dword [esi + 0x20], ecx
mov ecx, dword [ebx + 0xc18]
mov dword [esi + 0x24], ecx
mov eax, dword [ebx + 0xc1c]
mov dword [esi + 0x28], eax
mov edx, dword [ebx + 0xc20]
mov dword [esi + 0x2c], edx
mov ecx, dword [ebx + 0xc24]
mov dword [esi + 0x30], ecx
mov eax, dword [ebx + 0xc28]
mov dword [esi + 0x34], eax
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x104]
inc dword [edx + 0x104]
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x460bdc
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff664
mov esi, edx
mov edi, eax
mov ebp, 0x4a94c8
push esp
push 0x20019
push 0
push edi
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x460c0d
xor eax, eax
jmp 0x460d76
mov edx, esi
mov eax, 0x80000001
call fcn.00460d81
lea edx, [esp + 8]
push edx
lea ecx, [esp + 8]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push esi
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
je 0x460c4e
mov eax, dword [esp]
call fcn.00460f16
xor eax, eax
jmp 0x460d76
xor ebx, ebx
mov dword [esp + 0x10], 0xc8
mov dword [esp + 0x14], 0x3e8
lea eax, [esp + 0x14]
push eax
lea edx, [esp + 0xf0]
push edx
lea ecx, [esp + 0x14]
push ecx
push 0
lea eax, [esp + 0x20]
push eax
lea edx, [esp + 0x38]
push edx
push ebx
push dword [esp + 0x1c]
call sub.ADVAPI32.DLL_RegEnumValueA
test eax, eax
jne 0x460caf
push dword [esp + 0x14]
lea ecx, [esp + 0xf0]
push ecx
push dword [esp + 0x14]
push 0
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x18]
call sub.ADVAPI32.DLL_RegSetValueExA
inc ebx
jmp 0x460c50
xor ebx, ebx
mov dword [esp + 0x18], 0xc8
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x4e8]
push ecx
push ebx
push dword [esp + 0x1c]
call sub.ADVAPI32.DLL_RegEnumKeyExA
test eax, eax
jne 0x460d63
lea eax, [esp + 0x4d4]
lea edx, [ebp + 0x1e]
push eax
push edi
push edx
lea ecx, [esp + 0x5a8]
push ecx
call fcn.0049abd0
add esp, 0x10
lea edx, [ebp + 0x1e]
lea eax, [esp + 0x4d4]
push eax
push esi
push edx
lea ecx, [esp + 0x7a8]
push ecx
call fcn.0049abd0
add esp, 0x10
lea eax, [esp + 8]
push eax
lea edx, [esp + 8]
push edx
push 0
push 0x20006
push 0
push 0
push 0
lea ecx, [esp + 0x7b8]
push ecx
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
jne 0x460d63
lea edx, [esp + 0x79c]
lea eax, [esp + 0x59c]
call fcn.00460bdc
inc ebx
jmp 0x460cb1
mov eax, dword [esp]
call fcn.00460f16
mov eax, dword [esp + 4]
call fcn.00460f16
mov al, 1
add esp, 0x99c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x460db7
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov esi, edx
push edi
add esp, 0xfffffd28
mov edi, eax
cmp byte [esi], 0
je 0x460e52
push esp
push 0x20019
push 0
push esi
push edi
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x460e52
xor ebx, ebx
mov dword [esp + 4], 0xc8
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x24]
push ecx
push ebx
push dword [esp + 0x1c]
call sub.ADVAPI32.DLL_RegEnumKeyExA
test eax, eax
jne 0x460e39
lea eax, [esp + 0x10]
push eax
push esi
push 0x4a94e6
lea edx, [esp + 0xe4]
push edx
call fcn.0049abd0
add esp, 0x10
mov eax, edi
lea edx, [esp + 0xd8]
call fcn.00460db7
inc ebx
jmp 0x460de2
mov eax, dword [esp]
call fcn.00460f16
push esi
push edi
call sub.ADVAPI32.DLL_RegDeleteKeyA
test eax, eax
jne 0x460e52
inc dword [0x4cb164]
add esp, 0x2d8
pop edi
pop esi
pop ebx
ret
Function at 0x460fb8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00460e5c
mov ebx, eax
test ebx, ebx
je 0x460ffb
push esi
call fcn.00497cb0
pop ecx
inc eax
push eax
push esi
push 1
push 0
push dword [ebp - 8]
push ebx
call sub.ADVAPI32.DLL_RegSetValueExA
mov dword [ebp - 0xc], eax
mov eax, ebx
call fcn.00460f16
mov eax, dword [ebp - 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x461018
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff54
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 8]
call fcn.0041043c
test eax, eax
je 0x461089
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00460e5c
mov ebx, eax
test ebx, ebx
je 0x4610c4
lea edx, [ebp - 0xac]
mov ecx, 0x1000000
mov eax, dword [ebp - 8]
call fcn.004104b4
mov eax, esi
call fcn.00410768
add eax, eax
lea edx, [ebp - 0xac]
add eax, 2
push eax
push esi
push 1
push 0
push edx
push ebx
call sub.ADVAPI32.DLL_RegSetValueExW
mov dword [ebp - 0xc], eax
mov eax, ebx
call fcn.00460f16
jmp 0x4610c4
mov eax, esi
call fcn.00410768
add eax, eax
add eax, 2
push eax
call fcn.00496490
pop ecx
mov ebx, eax
mov ecx, 0x1000000
mov edx, ebx
mov eax, esi
call fcn.00410490
push ebx
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00460fb8
mov dword [ebp - 0xc], eax
push ebx
call fcn.004962cc
pop ecx
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4610e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 8]
call fcn.00460e5c
mov ebx, eax
test ebx, ebx
je 0x461115
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push dword [ebp - 4]
push ebx
call sub.ADVAPI32.DLL_RegSetValueExA
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00460f16
mov eax, dword [ebp - 8]
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x461138
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 8]
call fcn.00460e5c
mov ebx, eax
test ebx, ebx
je 0x46116d
push dword [ebp + 8]
push dword [ebp + 0xc]
push 3
push 0
push dword [ebp - 4]
push ebx
call sub.ADVAPI32.DLL_RegSetValueExA
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00460f16
mov eax, dword [ebp - 8]
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x4611e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
call fcn.00460ecc
mov ebx, eax
mov esi, 1
test ebx, ebx
je 0x461222
lea eax, [ebp + 8]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
push 0
push dword [ebp - 8]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov esi, eax
mov eax, ebx
call fcn.00460f16
test esi, esi
jne 0x46122c
cmp dword [ebp + 8], 0
jne 0x46123c
push dword [ebp + 0xc]
push edi
call fcn.00497c80
add esp, 8
xor eax, eax
jmp 0x46123e
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x461264
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff54
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 0x10]
call fcn.0041043c
test eax, eax
je 0x4612e2
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00460ecc
mov ebx, eax
lea edx, [ebp - 0xac]
mov ecx, 0x1000000
mov eax, dword [ebp - 8]
call fcn.004104b4
mov esi, 1
test ebx, ebx
je 0x4612cd
lea eax, [ebp + 8]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
lea ecx, [ebp - 0xac]
push 0
push ecx
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExW
mov esi, eax
mov eax, ebx
call fcn.00460f16
test esi, esi
jne 0x4612d7
cmp dword [ebp + 8], 0
ja 0x4612db
xor ebx, ebx
jmp 0x46131a
mov ebx, 1
jmp 0x46131a
mov eax, dword [ebp + 8]
inc eax
push eax
call fcn.00496490
pop ecx
mov esi, eax
push esi
push 0x4a94c8
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004611e0
mov ebx, eax
mov ecx, dword [ebp + 8]
mov edx, edi
mov eax, esi
call fcn.004104b4
push esi
call fcn.004962cc
pop ecx
test bl, bl
jne 0x461328
mov edx, dword [ebp + 0xc]
mov eax, edi
call fcn.0041077c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x461334
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
call fcn.00460ecc
mov ebx, eax
mov esi, 1
mov dword [ebp - 0x10], 4
test ebx, ebx
je 0x46137d
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
push 0
push dword [ebp - 8]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov esi, eax
mov eax, ebx
call fcn.00460f16
test esi, esi
jne 0x461387
cmp dword [ebp - 0x10], 0
jne 0x461390
mov edx, dword [ebp + 8]
xor eax, eax
mov dword [edi], edx
jmp 0x461392
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4613e4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, dword [ebp + 8]
call fcn.00460ecc
mov ebx, eax
mov dword [ebp - 0xc], esi
mov edi, 1
test ebx, ebx
je 0x461425
lea eax, [ebp - 0xc]
lea edx, [ebp - 8]
push eax
push dword [ebp + 0x10]
push edx
push 0
push dword [ebp - 4]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov edi, eax
mov eax, ebx
call fcn.00460f16
test edi, edi
jne 0x46142f
cmp dword [ebp - 0xc], 0
jne 0x461458
cmp dword [ebp + 0xc], 0
je 0x461446
push esi
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.00497a90
add esp, 0xc
jmp 0x461454
push esi
push 0
push dword [ebp + 0x10]
call fcn.00497b00
add esp, 0xc
xor eax, eax
jmp 0x46145b
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x461474
Capabilities:
Delete registry key

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, eax
mov eax, ebx
push 0x100
lea ecx, [esp + 4]
call fcn.00460f32
test al, al
je 0x461498
push esp
push ebx
call sub.ADVAPI32.DLL_RegDeleteKeyA
add esp, 0x100
pop ebx
ret

Function at 0x4614b0
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, ecx
mov ebx, eax
mov eax, ebx
push 0x100
lea ecx, [esp + 8]
call fcn.00460f32
test al, al
je 0x4614f9
push esp
push 0x20006
push 0
lea edx, [esp + 0x10]
push edx
push ebx
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4614f9
push esi
push dword [esp + 4]
call sub.ADVAPI32.DLL_RegDeleteValueA
mov eax, dword [esp]
call fcn.00460f16
add esp, 0x104
pop esi
pop ebx
ret
Function at 0x463258
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push 0x4ae0d0
push 1
push 0
push 0x4ae100
call sub.OLE32.DLL_CoCreateInstance
test eax, eax
jl 0x463323
push edi
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x50]
test esi, esi
je 0x4632a4
push esi
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp dword [ebp + 0xc], 0
je 0x4632b8
push 0
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x44]
cmp dword [ebp + 8], 0
je 0x4632ca
push dword [ebp + 8]
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x2c]
lea eax, [ebp - 0xc]
push eax
push 0x4ae130
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx]
test eax, eax
jl 0x46331a
push 0x104
lea eax, [ebp - 0x214]
push eax
push 0xffffffffffffffff
push dword [ebp - 4]
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
push 1
lea edx, [ebp - 0x214]
push edx
mov ecx, dword [ebp - 0xc]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
test eax, eax
jl 0x463311
mov bl, 1
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x463330
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
push esp
call sub.SHELL32.DLL_SHGetMalloc
lea eax, [esp + 4]
push eax
push 0x10
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push ebx
push dword [esp + 8]
call sub.SHELL32.DLL_SHGetPathFromIDListA
push dword [esp + 4]
mov edx, dword [esp + 4]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
pop ecx
pop edx
pop ebx
ret

Function at 0x463368
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
push esp
call sub.SHELL32.DLL_SHGetMalloc
lea eax, [esp + 4]
push eax
push 0x19
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push ebx
push dword [esp + 8]
call sub.SHELL32.DLL_SHGetPathFromIDListA
push dword [esp + 4]
mov edx, dword [esp + 4]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
pop ecx
pop edx
pop ebx
ret

Function at 0x4633a0
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push ebx
add esp, 0xffffffe0
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x4633b5
xor eax, eax
jmp 0x4633f3
push ebx
call fcn.00497cb0
pop ecx
mov byte [ebx + eax + 1], 0
push 0x1e
push 0
lea edx, [esp + 8]
push edx
call fcn.00497b00
add esp, 0xc
mov dword [esp + 4], 3
mov word [esp + 0x10], 0x14
mov dword [esp + 8], ebx
push esp
call sub.SHELL32.DLL_SHFileOperationA
test eax, eax
sete al
and eax, 1
add esp, 0x20
pop ebx
ret
Function at 0x463a04
Capabilities:
Create directory

Disassembly:
push ebx
push esi
add esp, 0xfffffc00
mov esi, edx
mov ebx, eax
mov eax, esp
mov edx, 0x400
call fcn.00463dbc
mov eax, esp
call fcn.0040c22c
push ebx
lea edx, [esp + 4]
push edx
call fcn.00497ba4
add esp, 8
mov eax, esp
call fcn.0040acb0
test eax, eax
je 0x463a4c
push 0
lea edx, [esp + 4]
push edx
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
jne 0x463a6e
push esp
mov eax, 0x1f7
call fcn.004125d0
push eax
call fcn.00486954
add esp, 8
mov eax, 0x4b1b14
call fcn.0042d7a8
xor eax, eax
jmp 0x463a7a
push esp
push esi
call fcn.00497c80
add esp, 8
mov al, 1
add esp, 0x400
pop esi
pop ebx
ret

Function at 0x463bf0
Capabilities:
Capture screenshot

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd8
mov dword [esp], eax
call sub.USER32.DLL_GetDesktopWindow
mov ebp, eax
push ebp
call sub.USER32.DLL_GetDC
mov edi, eax
push edi
call sub.GDI32.DLL_CreateCompatibleDC
mov ebx, eax
push edi
call sub.GDI32.DLL_CreateCompatibleDC
mov esi, eax
lea eax, [esp + 0x10]
push eax
push 0x18
push dword [esp + 8]
call sub.GDI32.DLL_GetObjectA
push dword [esp + 0x18]
push dword [esp + 0x18]
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [esp + 4], eax
push dword [esp]
push ebx
call sub.GDI32.DLL_SelectObject
mov dword [esp + 8], eax
push dword [esp + 4]
push esi
call sub.GDI32.DLL_SelectObject
mov dword [esp + 0xc], eax
push 0xcc0020
mov edx, dword [esp + 0x1c]
push edx
mov eax, dword [esp + 0x1c]
mov ecx, eax
neg ecx
push ecx
mov ecx, eax
dec ecx
push 0
push ecx
push ebx
push edx
push eax
push 0
push 0
push esi
call sub.GDI32.DLL_StretchBlt
push 0xcc0020
push 0
push 0
push esi
push dword [esp + 0x28]
push dword [esp + 0x28]
push 0
push 0
push ebx
call sub.GDI32.DLL_BitBlt
push dword [esp + 8]
push ebx
call sub.GDI32.DLL_SelectObject
push dword [esp + 0xc]
push esi
call sub.GDI32.DLL_SelectObject
push dword [esp + 4]
call sub.GDI32.DLL_DeleteObject
push ebx
call sub.GDI32.DLL_DeleteDC
push esi
call sub.GDI32.DLL_DeleteDC
push edi
push ebp
call sub.USER32.DLL_ReleaseDC
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x463dbc
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable

Disassembly:
push ebx
push esi
add esp, 0xfffffc00
mov esi, edx
mov ebx, eax
mov eax, 0x4a9e49
push 0x4a9e37
push esi
mov ecx, ebx
mov edx, 0x4a9e4f
call fcn.004611c4
mov byte [esp], 0
cmp byte [ebx], 0
je 0x463e07
push 0x400
lea eax, [esp + 4]
push eax
push ebx
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
test eax, eax
je 0x463e07
mov edx, esp
mov ecx, esi
mov eax, ebx
call fcn.0040f43c
cmp byte [ebx], 0
je 0x463e17
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x463e35
push ebx
push esi
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
je 0x463e27
cmp byte [ebx], 0
jne 0x463e35
push 0x4a9e5a
push ebx
call fcn.00497c80
add esp, 8
mov eax, ebx
call fcn.0040c22c
add esp, 0x400
pop esi
pop ebx
ret