joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46eb25
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x783760]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x6c2470]
mov dword [ebp - 0xc], eax
mov eax, dword [0x6c2474]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
add eax, 0x41
mov word [ebp - 0xc], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, dword [ebp - 4]
dec eax
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.0056e1bf
mov esp, ebp
pop ebp
ret 4

Function at 0x46eb70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x783760]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor esi, esi
push esi
push esi
push 3
push esi
push 1
push SysReAllocString
push eax
call fcn.005654e9
mov edi, eax
add esp, 0x1c
cmp edi, 0xffffffff
je 0x46ec29
lea eax, [ebp - 0x224]
mov dword [ebp - 0x228], esi
push 0x220
push eax
call fcn.0059e3f3
pop ecx
pop ecx
push esi
lea eax, [ebp - 0x228]
push eax
push 0x220
lea eax, [ebp - 0x224]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46ec22
cmp dword [ebp - 0x228], 0x220
jne 0x46ec22
lea eax, [ebp - 0x20c]
push eax
call fcn.00647fd1
pop ecx
test eax, eax
je 0x46ec22
cmp word [ebp - 0x20a], 0x3a
jne 0x46ec22
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.004179fb
lea esi, [ebx + 4]
cmp dword [esi + 0x14], 8
jb 0x46ec22
mov esi, dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056e1bf
mov esp, ebp
pop ebp
ret 8
Function at 0x46f1bc
Capabilities:
Empty the recycle bin

Disassembly:
push 0x10
mov eax, 0x68cff1
call fcn.0056e207
mov esi, ecx
xor ebx, ebx
call fcn.00564e5d
mov edi, dword [ebp + 8]
test eax, eax
je 0x46f269
push edi
mov ecx, esi
call fcn.0046e965
mov dword [ebp + 8], eax
test eax, eax
je 0x46f3b0
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], eax
and dword [eax + 0x24], ebx
mov dword [ebp - 4], 1
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00537793
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x14], esp
mov dword [ebp - 0x10], eax
and dword [eax + 0x24], ebx
mov dword [ebp - 4], 3
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0053773f
sub esp, 0x28
lea eax, [esi + 0x1e0]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.0058f9a0
mov dword [ebp - 4], 4
push dword [ebp + 8]
push edi
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00537bc9
mov ecx, dword [ebp + 8]
mov ebx, eax
push 1
mov eax, dword [ecx]
call dword [eax]
jmp 0x46f395
push 2
xor ebx, ebx
mov dword [esi + 0x208], edi
pop eax
inc ebx
mov dword [ebp + 8], eax
push eax
mov ecx, esi
call fcn.0046eb25
test eax, eax
je 0x46f37e
push 0
push 1
push 2
push 0x6c24b0
push dword [ebp + 8]
mov ecx, esi
push edi
call fcn.0046e79b
mov dword [ebp - 0x10], eax
test eax, eax
je 0x46f37a
sub esp, 0x28
mov dword [ebp - 0x14], esp
mov ecx, esp
sub esp, 0xc
mov eax, esp
mov dword [eax], 0x46e6f2
mov dword [eax + 8], esi
call fcn.0046e49c
mov dword [ebp - 4], 5
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00537793
sub esp, 0x28
mov dword [ebp - 0x18], esp
mov ecx, esp
sub esp, 0xc
mov eax, esp
mov dword [eax], 0x46f6a6
mov dword [eax + 8], esi
call fcn.0046e49c
mov dword [ebp - 4], 6
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0053773f
sub esp, 0x28
lea eax, [esi + 0x1e0]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
call fcn.0058f9a0
mov dword [ebp - 4], 7
push dword [ebp - 0x10]
push edi
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00537bc9
sub esp, 0x28
mov ebx, eax
mov eax, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], eax
and dword [eax + 0x24], 0
mov dword [ebp - 4], 9
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00537793
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], eax
and dword [eax + 0x24], 0
mov dword [ebp - 4], 0xb
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0053773f
mov ecx, dword [ebp - 0x10]
push 1
mov eax, dword [ecx]
call dword [eax]
test ebx, ebx
je 0x46f38e
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
cmp eax, 0x19
jle 0x46f278
and dword [esi + 0x208], 0
test ebx, ebx
je 0x46f3b0
push edi
call fcn.004c1587
pop ecx
test eax, eax
je 0x46f3b0
push 7
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
mov eax, ebx
call fcn.0056e1d0
ret 4
Function at 0x470833
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x783760]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
push 0x3bc
push ebx
lea eax, [esi + 8]
mov dword [0x796884], esi
push eax
call fcn.00644240
push 0x110
xor edi, edi
mov dword [esi + 0x3d4], ebx
inc edi
mov dword [esi + 0x418], ebx
lea eax, [ebp - 0x114]
mov dword [esi + 0x3d8], edi
push ebx
push eax
mov dword [esi + 0x3dc], edi
mov dword [esi + 0x3e0], edi
mov dword [esi + 0x41c], edi
mov dword [esi + 0x3e4], ebx
mov dword [esi + 0x3fc], ebx
mov dword [esi + 0x414], ebx
mov dword [esi + 0x3cc], ebx
mov dword [esi + 0x420], ebx
mov dword [esi + 0x424], ebx
mov dword [esi + 0x3d0], ebx
mov dword [ebp - 0x118], 0x114
call fcn.00644240
add esp, 0x18
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x4708f1
cmp dword [ebp - 0x114], 5
jae 0x4708f3
mov edi, ebx
mov ecx, dword [ebp - 4]
mov dword [esi + 0x3e8], edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0056e1bf
mov esp, ebp
pop ebp
ret
Function at 0x47257a
Capabilities:
Create directory

Disassembly:
push 0xa4
mov eax, 0x68d597
call fcn.0056e23b
mov esi, ecx
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x2c]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
and dword [ebp - 0xa8], 0
mov dword [ebp - 0xac], eax
call fcn.004173bc
and dword [ebp - 4], 0
lea eax, [ebx + 4]
cmp dword [eax + 0x14], 8
jb 0x4725b8
mov eax, dword [eax]
push eax
push edi
lea eax, [ebp - 0x2c]
push 0x6b6c74
push eax
call fcn.0041ccda
mov eax, dword [esi]
add esp, 0x10
mov ecx, dword [ebx + 0x30]
cmp ecx, dword [eax + 0x84]
jae 0x47265c
push 4
call fcn.0056def4
mov edi, eax
pop ecx
mov dword [ebp - 0xb0], edi
mov byte [ebp - 4], 1
test edi, edi
je 0x472600
mov eax, dword [esi]
mov dword [edi], eax
inc dword [eax + 0x88]
jmp 0x472602
xor edi, edi
mov byte [ebp - 4], 0
test edi, edi
je 0x472774
mov eax, dword [ebx + 0x1c]
mov esi, dword [eax]
cmp esi, eax
je 0x472645
push dword [ebp - 0xac]
cmp dword [ebp - 0x14], 8
lea eax, [esi + 8]
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push eax
push ecx
mov ecx, edi
call fcn.0047257a
mov dword [ebp - 0xa8], eax
test eax, eax
jne 0x472645
mov esi, dword [esi]
cmp esi, dword [ebx + 0x1c]
jne 0x472617
mov eax, dword [edi]
push 4
push edi
dec dword [eax + 0x88]
call fcn.0056df27
pop ecx
pop ecx
jmp 0x472774
mov eax, dword [ebx + 0x2c]
mov edx, 0x400
test eax, eax
jne 0x472675
cmp dword [ebx + 0x20], edx
jb 0x47267e
test eax, eax
je 0x472774
cmp dword [ebx + 0x20], edx
jae 0x472774
lea eax, [ecx + 1]
push eax
push ebx
lea ecx, [ebp - 0xa4]
call fcn.0047223e
mov byte [ebp - 4], 2
lea edi, [ebx + 0x1c]
push eax
push dword [edi]
mov ecx, edi
call fcn.00472162
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa4]
call fcn.004723d6
lea ecx, [ebp - 0x64]
call fcn.004173bc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x48]
call fcn.004173bc
mov byte [ebp - 4], 4
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x48]
lea esi, [ebp - 0x28]
mov ecx, ebx
cmovae esi, dword [ebp - 0x28]
push eax
call fcn.004732d0
push eax
push esi
lea eax, [ebp - 0x64]
push 0x6b6c74
push eax
call fcn.0041ccda
add esp, 0x10
lea eax, [ebp - 0x60]
cmp dword [ebp - 0x4c], 8
cmovae eax, dword [ebp - 0x60]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x472735
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
je 0x4726c6
mov eax, dword [edi]
mov ecx, edi
push dword [eax + 4]
lea eax, [ebp - 0xb0]
push eax
call fcn.00473503
call esi
mov ecx, dword [ebp - 0xac]
mov dword [ecx], eax
jmp 0x47275c
mov eax, dword [edi]
lea ecx, [ebp - 0x44]
cmp dword [ebp - 0x30], 8
cmovae ecx, dword [ebp - 0x44]
mov eax, dword [eax + 4]
push ecx
lea ecx, [eax + 8]
call fcn.004179fb
mov eax, dword [edi]
mov eax, dword [eax + 4]
add eax, 8
mov dword [ebp - 0xa8], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x48]
call fcn.0041786a
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.0041786a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0041786a
mov eax, dword [ebp - 0xa8]
call fcn.0056e1e5
ret 0xc
Function at 0x473359
Capabilities:
Delete file

Disassembly:
push 0x20
mov eax, 0x68e2b1
call fcn.0056e23b
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
call fcn.004173bc
and dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push esi
push str._s:1:_Data
push eax
call fcn.0041ccda
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
xor ecx, ecx
push ecx
push 0x80
push 1
push ecx
push ecx
push 0x10000000
push eax
call fcn.005654e9
mov esi, eax
add esp, 0x28
cmp esi, 0xffffffff
je 0x4733e4
push ebx
push esi
mov ecx, edi
call fcn.0045f88a
cmp dword [ebp + 0x10], 0
je 0x4733cb
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0041786a
call fcn.0056e1e5
ret 0x10

Function at 0x477afe
Capabilities:
Check if file exists

Disassembly:
push 0x28
mov eax, 0x6a46e0
call fcn.0056e23b
mov edi, dword [ebp + 8]
xor eax, eax
mov esi, dword [ebp + 0xc]
test edi, edi
je 0x477bd3
mov ebx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
push ebx
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], eax
mov word [ebp - 0x28], ax
call fcn.00647fd1
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x28]
call fcn.004044d0
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x2c], eax
push edi
push str._s_thm
push esi
call fcn.0041ccda
add esp, 0xc
xor ebx, ebx
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x34]
push 0
push 0x77de48
call fcn.004531aa
cmp dword [ebp - 0x18], eax
jbe 0x477bdb
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
movzx eax, word [ecx + eax*2]
mov ecx, esi
push eax
call fcn.0043b162
inc ebx
cmp ebx, 4
jb 0x477b60
push str..tmp
mov ecx, esi
call fcn.00419c79
lea eax, [esi + 4]
cmp dword [eax + 0x14], 8
jb 0x477bab
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x477b4f
add esi, 4
cmp dword [esi + 0x14], 8
jb 0x477bc1
mov esi, dword [esi]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.00401d60
mov eax, esi
call fcn.0056e1e5
ret 8
push str.invalid_string_position
call fcn.0056af4e
int3
Function at 0x47cb73
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x1c], edi
jne 0x47cb89
mov edi, 0x10d8
jmp 0x47cbf7
mov eax, dword [esi + 0xd8]
test eax, eax
je 0x47cbaf
mov ecx, dword [esi + 0xe4]
cmp ecx, 0xffffffff
je 0x47cbaf
push 1
lea edx, [ebp - 1]
mov byte [ebp - 1], 1
push edx
push 4
push ecx
call eax
jmp 0x47cbeb
cmp dword [esi + 0xe4], 0xffffffff
je 0x47cbbf
mov ecx, esi
call fcn.0047cb3d
cmp byte [esi + 4], 0
je 0x47cbd9
add esi, 0x28
cmp dword [esi + 0x14], 8
jb 0x47cbd0
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x47cbeb
add esi, 0x28
cmp dword [esi + 0x14], 8
jb 0x47cbe4
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x47cbf7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x47cbff
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x783760]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ecx + 0xdc]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 8]
test edx, edx
je 0x47cc40
mov eax, dword [ecx + 0xe4]
cmp eax, 0xffffffff
je 0x47cc40
push 0x28
lea ecx, [ebp - 0x2c]
push ecx
push esi
push eax
call edx
test eax, eax
je 0x47cc5e
mov eax, dword [ebp - 0xc]
mov dword [edi], eax
jmp 0x47cc6b
cmp dword [ecx + 0x1c], esi
je 0x47cc68
lea eax, [ecx + 0xc]
cmp dword [eax + 0x14], 8
jb 0x47cc50
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x47cc6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x47cc6b
push 2
pop esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0056e1bf
mov esp, ebp
pop ebp
ret 4
Function at 0x47d31c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x783760]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi + 0xd8], esi
je 0x47d37d
mov eax, dword [edi + 0xe4]
cmp eax, 0xffffffff
je 0x47d37d
push 0x28
lea ecx, [ebp - 0x2c]
push ecx
push esi
push eax
call dword [edi + 0xdc]
test eax, eax
je 0x47d3c7
cmp byte [ebp + 0xc], 0
mov eax, dword [ebp + 8]
je 0x47d365
or dword [ebp - 0xc], eax
jmp 0x47d368
mov dword [ebp - 0xc], eax
push 0x28
lea eax, [ebp - 0x2c]
push eax
push esi
push dword [edi + 0xe4]
call dword [edi + 0xd8]
jmp 0x47d3c3
cmp dword [edi + 0x1c], esi
je 0x47d3d1
cmp byte [ebp + 0xc], 0
je 0x47d3ae
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], esi
push eax
call fcn.0047cbff
mov esi, eax
test esi, esi
jne 0x47d3d4
mov eax, dword [ebp - 0x30]
add edi, 0xc
or eax, dword [ebp + 8]
cmp dword [edi + 0x14], 8
jb 0x47d3ab
mov edi, dword [edi]
push eax
jmp 0x47d3bc
add edi, 0xc
cmp dword [edi + 0x14], 8
jb 0x47d3b9
mov edi, dword [edi]
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x47d3d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x47d3d4
push 2
pop esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0056e1bf
mov esp, ebp
pop ebp
ret 8
Function at 0x47d806
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
xor esi, esi
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push 0
push eax
mov eax, dword [ebp + 0xc]
sub eax, esi
push eax
lea eax, [esi + ebx]
push eax
push dword [edi + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x47d843
add esi, dword [ebp + 8]
cmp esi, dword [ebp + 0xc]
jb 0x47d813
xor eax, eax
jmp 0x47d849
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x47d8ec
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov esi, ecx
call fcn.0047d894
xor eax, eax
cmp dword [esi + 4], eax
jne 0x47d973
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x47d973
push edi
call fcn.0056e306
mov dword [esi + 4], eax
pop ecx
test eax, eax
je 0x47d973
push eax
push edi
push dword [ebp - 4]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x47d96c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push str.VarFileInfoTranslation
push dword [esi + 4]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x47d96c
mov eax, dword [ebp - 8]
movzx ecx, word [eax]
movzx eax, word [eax + 2]
shl ecx, 0x10
or ecx, eax
xor eax, eax
mov dword [esi + 8], ecx
inc eax
jmp 0x47d975
mov ecx, esi
call fcn.0047d894
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x47e09b
Capabilities:
Check if file exists

Disassembly:
push 0x2c
mov eax, 0x68ef92
call fcn.0056e23b
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
test ebx, ebx
je 0x47e189
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x47e189
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
push str.0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ__________
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], eax
mov word [ebp - 0x28], ax
call fcn.00647fd1
pop ecx
push eax
push str.0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ__________
lea ecx, [ebp - 0x28]
call fcn.004044d0
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x30], eax
push ebx
push 0x6c4df0
push esi
call fcn.0041ccda
and dword [ebp - 0x2c], 0
add esp, 0xc
test edi, edi
je 0x47e14a
push dword [ebp - 0x30]
lea ecx, [ebp - 0x38]
push 0
push 0x780568
call fcn.004531aa
cmp dword [ebp - 0x18], eax
jbe 0x47e17f
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
movzx eax, word [ecx + eax*2]
mov ecx, esi
push eax
call fcn.0043b162
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, edi
jb 0x47e111
lea eax, [esi + 4]
cmp dword [eax + 0x14], 8
jb 0x47e155
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x47e0fa
add esi, 4
cmp dword [esi + 0x14], 8
jb 0x47e16b
mov esi, dword [esi]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.00401d60
mov eax, esi
jmp 0x47e18b
push str.invalid_string_position
call fcn.0056af4e
xor eax, eax
call fcn.0056e1e5
ret 0xc

Function at 0x47ff0e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x24
mov eax, 0x690f1b
call fcn.0056e23b
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x2c]
mov ebx, dword [ebp + 8]
xor esi, esi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
call fcn.004173bc
mov dword [ebp - 4], esi
lea eax, [ebp - 0x2c]
cmp dword [ebp + 0x14], esi
je 0x47ff8d
push dword [ebp - 0x30]
push ebx
push 0x6c6a00
push eax
call fcn.0041ccda
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0x20019
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00567b83
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x47ffc4
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], esi
push eax
push esi
push esi
test edi, edi
mov eax, 0x6c6a0c
push esi
cmovne eax, edi
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
neg eax
push ebx
sbb esi, esi
inc esi
jmp 0x47ffbe
push edi
push dword [ebp - 0x30]
push ebx
push str._s_s_s
push eax
call fcn.0041ccda
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0x20019
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00567b83
add esp, 0x1c
test eax, eax
je 0x47ffc4
xor esi, esi
inc esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0041786a
mov eax, esi
call fcn.0056e1e5
ret 0x10
Function at 0x4802d2
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 2
push dword [ebp + 8]
xor esi, esi
inc esi
call fcn.00567b83
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x480308
push dword [ebp + 0xc]
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
je 0x480301
cmp eax, 2
je 0x480301
xor esi, esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x480310
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 2
push dword [ebp + 8]
xor esi, esi
inc esi
call fcn.00567b83
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x48034b
push dword [ebp + 0xc]
push 0x6c71e8
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
test eax, eax
je 0x480344
cmp eax, 2
je 0x480344
xor esi, esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x480d91
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x4c
mov eax, 0x68f53b
call fcn.0056e23b
mov esi, ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x14]
push 0x8000
mov dword [ebp - 0x50], eax
call fcn.0056e306
mov edi, eax
pop ecx
test edi, edi
je 0x480ed5
mov ebx, dword [ebp - 0x50]
xor eax, eax
cmp dword [ebx], eax
jne 0x480e41
lea ecx, [ebp - 0x2c]
call fcn.004173bc
and dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push dword [ebp - 0x54]
push dword [ebp - 0x4c]
push 0x6c71dc
push eax
call fcn.0041ccda
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0x20019
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00567b83
add esp, 0x18
mov dword [ebx], eax
test eax, eax
jne 0x480e2f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0041786a
jmp 0x480ece
and dword [esi + 0x1c], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0041786a
xor eax, eax
cmp dword [ebp + 0x18], 0
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], 0x3fff
push eax
push edi
push dword [esi + 0x1c]
push dword [ebx]
je 0x480e64
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x480e6a
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, eax
test ebx, ebx
jne 0x480ecb
lea ecx, [ebp - 0x48]
call fcn.004173bc
mov dword [ebp - 4], 1
lea eax, [ebp - 0x44]
push ebx
push eax
push edi
mov ecx, esi
call fcn.00480edf
test eax, eax
jne 0x480eb6
push 1
lea eax, [ebp - 0x44]
mov ecx, esi
push eax
push edi
call fcn.00480edf
test eax, eax
jne 0x480eb6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.0041786a
inc dword [esi + 0x1c]
mov ebx, dword [ebp - 0x50]
jmp 0x480e3f
mov ecx, dword [ebp - 0x58]
push edi
call fcn.004041d0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.0041786a
inc dword [esi + 0x1c]
push edi
call fcn.0056e30f
pop ecx
mov eax, ebx
call fcn.0056e1e5
ret 0x14