joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452930
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x510620]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x51af98]
mov dword [ebp - 0x408], 0
push esi
mov esi, ecx
test al, 1
jne 0x45298a
or eax, 1
mov dword [0x51afb0], 7
mov dword [0x51af98], eax
xor eax, eax
push 0x4dbb10
mov dword [0x51afac], 0
mov word [0x51af9c], ax
call fcn.004957fd
add esp, 4
cmp dword [0x51afac], 0
jne 0x452a01
xor eax, eax
push 0x3fe
push eax
mov word [ebp - 0x404], ax
lea eax, [ebp - 0x402]
push eax
call fcn.0049aba0
add esp, 0xc
lea eax, [ebp - 0x404]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x452a01
cmp word [ebp - 0x404], 0
jne 0x4529d6
xor ecx, ecx
jmp 0x4529ef
lea ecx, [ebp - 0x404]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4529e0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x404]
mov ecx, 0x51af9c
push eax
call fcn.00402710
xor eax, eax
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
push eax
mov dword [esi + 0x10], 0
mov ecx, esi
push 0x51af9c
mov word [esi], ax
call fcn.00402990
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00494c10
mov esp, ebp
pop ebp
ret

Function at 0x452b80
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d635b
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x510620]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 2
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
je 0x452bff
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x452bf0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402710
push 1
push 0x4e9238
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], 0
call fcn.00406030
push 7
push 0x4e6da4
mov ecx, eax
call fcn.00406030
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
cmovae ecx, dword [ebp - 0x230]
call fcn.00452ee0
cmp dword [ebp - 0x21c], 8
mov bl, al
jb 0x452c6b
push dword [ebp - 0x230]
call fcn.00494c0b
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00494c10
mov esp, ebp
pop ebp
ret
Function at 0x452c90
Capabilities:
Delete file
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d639b
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x510620]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
push 0
push 2
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
jne 0x452cff
xor ecx, ecx
jmp 0x452d1f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
jmp 0x452d10
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x452d10
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402710
mov dword [ebp - 4], 0
test esi, esi
je 0x452d78
push 1
push 0x4e9238
lea ecx, [ebp - 0x230]
call fcn.00406030
cmp word [esi], 0
mov edx, eax
jne 0x452d5b
xor ecx, ecx
jmp 0x452d6f
mov ecx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x452d60
sub ecx, ebx
sar ecx, 1
push ecx
push esi
mov ecx, edx
call fcn.00406030
push 1
push 0x4e9238
lea ecx, [ebp - 0x230]
call fcn.00406030
cmp word [edi], 0
mov esi, eax
jne 0x452d96
xor ecx, ecx
jmp 0x452daf
mov ecx, edi
lea edx, [ecx + 2]
jmp 0x452da0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x452da0
sub ecx, edx
sar ecx, 1
push ecx
push edi
mov ecx, esi
call fcn.00406030
push 4
push 0x4ea1a4
mov ecx, eax
call fcn.00406030
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
cmp dword [ebp - 0x21c], 8
jb 0x452dfd
push dword [ebp - 0x230]
call fcn.00494c0b
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00494c10
mov esp, ebp
pop ebp
ret

Function at 0x452ee0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x510620]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
mov esi, ecx
push 0x3fe
push eax
mov word [ebp - 0x404], ax
lea eax, [ebp - 0x402]
push eax
call fcn.0049aba0
push esi
lea eax, [ebp - 0x404]
push 0x200
push eax
call fcn.00499e8b
add esp, 0x18
lea eax, [ebp - 0x404]
lea edx, [eax + 2]
pop esi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x452f30
sub eax, edx
sar eax, 1
lea eax, [eax*2 + 2]
cmp eax, 0x400
jae 0x452fbf
xor ecx, ecx
xorps xmm0, xmm0
mov word [ebp + eax - 0x404], cx
lea eax, [ebp - 0x404]
movdqu xmmword [ebp - 0x420], xmm0
mov dword [ebp - 0x41c], eax
mov eax, 0x614
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x424]
push eax
mov dword [ebp - 0x424], ecx
movq qword [ebp - 0x410], xmm0
mov word [ebp - 0x408], cx
mov dword [ebp - 0x420], 3
mov dword [ebp - 0x418], ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.00494c10
mov esp, ebp
pop ebp
ret
call fcn.00499daf
int3
Function at 0x452fd0
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x510620]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
mov esi, edx
mov eax, ecx
push esi
push eax
mov dword [ebp - 0x828], eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x45300d
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00494c10
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x45318c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x453081
test bl, 1
je 0x453033
and ebx, 0xfffffffe
cmp ebx, 0xffffffff
je 0x453040
test bl, 2
je 0x453040
and ebx, 0xfffffffd
cmp ebx, eax
je 0x453081
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x453081
push 0
push esi
push dword [ebp - 0x828]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x45318c
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop ebx
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00494c10
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0x3fe
push eax
mov word [ebp - 0x404], ax
lea eax, [ebp - 0x402]
push eax
call fcn.0049aba0
mov eax, 0x2030
push 0x3fe
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x802]
push 0
push eax
call fcn.0049aba0
push dword [ebp - 0x828]
lea eax, [ebp - 0x404]
push 0x200
push eax
call fcn.00499e8b
push esi
lea eax, [ebp - 0x804]
push 0x200
push eax
call fcn.00499e8b
lea ecx, [ebp - 0x404]
add esp, 0x30
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4530f0
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
cmp ecx, 0x400
jae 0x45319e
xor eax, eax
xorps xmm0, xmm0
mov word [ebp + ecx - 0x404], ax
mov dword [ebp - 0x824], eax
mov word [ebp - 0x808], ax
lea eax, [ebp - 0x404]
movdqu xmmword [ebp - 0x820], xmm0
mov dword [ebp - 0x81c], eax
lea eax, [ebp - 0x804]
mov dword [ebp - 0x818], eax
mov eax, 0x290
mov word [ebp - 0x814], ax
lea eax, [ebp - 0x824]
push eax
movq qword [ebp - 0x810], xmm0
mov dword [ebp - 0x820], 2
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
pop ebx
sbb eax, eax
inc eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00494c10
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop ebx
xor ecx, ebp
pop esi
call fcn.00494c10
mov esp, ebp
pop ebp
ret
call fcn.00499daf
int3
Function at 0x453250
Capabilities:
Check for time delay via gettickcount
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
mov eax, dword [0x510620]
xor eax, esp
mov dword [esp + 0x54], eax
push esi
push edi
push ecx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetProcessId]
test eax, eax
jne 0x453284
pop edi
pop esi
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.00494c10
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
call edi
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push eax
push 0x4531b0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x45336b
call edi
sub eax, dword [esp + 0x28]
cmp eax, esi
ja 0x453367
lea eax, [esp + 0x10]
mov dword [esp + 8], 0x64
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 0
call fcn.0044e0f0
add esp, 4
movdqu xmm0, xmmword [eax]
movdqu xmmword [esp + 0x30], xmm0
call fcn.00499590
cmp eax, 0xffffffff
je 0x45332d
lea eax, [esp + 0x48]
push 1
push eax
call fcn.0047fcf1
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.0047fbe9
push eax
call fcn.004996b0
add esp, 0x14
jmp 0x45333a
lea eax, [esp + 0x30]
push eax
call fcn.0047dc9a
add esp, 4
lea eax, [esp + 0x20]
push eax
push 0x4531b0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4532c4
pop edi
pop esi
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.00494c10
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x5c]
pop edi
pop esi
xor ecx, esp
call fcn.00494c10
mov esp, ebp
pop ebp
ret
Function at 0x453380
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d63db
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x510620]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x4533c8
mov eax, 1
jmp 0x453563
lea eax, [ebp - 0x240]
push eax
push 0x20019
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
test ecx, ecx
je 0x4533f1
xor eax, eax
cmp ecx, 2
sete al
jmp 0x453563
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x21c], 0x104
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x45354a
lea esp, [esp]
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
cmp word [edi], ax
je 0x453466
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x453457
sub eax, edx
sar eax, 1
push eax
push edi
lea ecx, [ebp - 0x234]
call fcn.00402710
push 1
push 0x4e9238
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 0
call fcn.00406030
cmp word [ebp - 0x218], 0
mov esi, eax
jne 0x45349c
xor ecx, ecx
jmp 0x4534b4
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4534a5
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00406030
cmp dword [ebp - 0x220], 8
lea edx, [ebp - 0x234]
mov ecx, ebx
cmovae edx, dword [ebp - 0x234]
call fcn.00453380
test eax, eax
je 0x45353f
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x21c], 0x104
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
cmp dword [ebp - 0x220], 8
jb 0x453535
push dword [ebp - 0x234]
call fcn.00494c0b
add esp, 4
test esi, esi
je 0x453430
jmp 0x45354a
lea ecx, [ebp - 0x234]
call fcn.00402110
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00494c10
mov esp, ebp
pop ebp
ret
Function at 0x4535e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6418
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x510620]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x30]
push 0x2a
xor eax, eax
mov dword [ebp - 0x1c], 7
push str.SOFTWAREJavaSoftJava_Runtime_Environment
mov dword [ebp - 0x20], 0
mov word [ebp - 0x30], ax
call fcn.00402710
push 1
push 0x4e9238
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0
call fcn.00406030
cmp word [esi], 0
mov dword [ebp - 0x3c], eax
jne 0x453658
xor ecx, ecx
jmp 0x453672
mov ecx, esi
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x453660
mov eax, dword [ebp - 0x3c]
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, eax
call fcn.00406030
cmp dword [ebp - 0x1c], 8
lea ecx, [ebp - 0x34]
push ecx
push 1
lea eax, [ebp - 0x30]
mov dword [ebp - 0x34], 0
cmovae eax, dword [ebp - 0x30]
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45372e
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x38]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push str.JavaHome
push dword [ebp - 0x34]
call edi
test eax, eax
jne 0x453725
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004962a5
mov esi, eax
add esp, 4
test esi, esi
je 0x453725
lea eax, [ebp - 0x38]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push 0
push str.JavaHome
push dword [ebp - 0x34]
call edi
push dword [ebp - 0x34]
test eax, eax
jne 0x453728
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x453715
push esi
mov ecx, ebx
call fcn.00402140
push esi
call fcn.0049626d
add esp, 4
mov esi, 1
jmp 0x453730
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
cmp dword [ebp - 0x1c], 8
jb 0x453741
push dword [ebp - 0x30]
call fcn.00494c0b
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00494c10
mov esp, ebp
pop ebp
ret
Function at 0x453760
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6448
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x510620]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x4c], ecx
movdqa xmm0, xmmword [0x4efc30]
xor eax, eax
mov edi, dword [ebp + 8]
movdqu xmmword [ebp - 0x6c], xmm0
mov dword [ebp - 0x5c], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x58], SysStringLen
mov dword [ebp - 0x50], eax
mov esi, dword [ebp + eax*4 - 0x6c]
lea ecx, [ebp - 0x3c]
push 0x2a
xor eax, eax
mov dword [ebp - 0x48], 0
push str.SOFTWAREJavaSoftJava_Runtime_Environment
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x2c], 0
mov word [ebp - 0x3c], ax
call fcn.00402710
mov dword [ebp - 4], 0
test edi, edi
je 0x45384b
mov edx, dword [ebp - 0x4c]
mov ecx, esi
push edi
call fcn.004535e0
add esp, 4
test eax, eax
je 0x453841
test ebx, ebx
je 0x4538d9
cmp word [edi], 0
jne 0x45381f
xor eax, eax
mov ecx, ebx
push eax
push edi
call fcn.00402710
jmp 0x4538d9
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x453824
sub eax, edx
mov ecx, ebx
sar eax, 1
push eax
push edi
call fcn.00402710
jmp 0x4538d9
cmp byte [ebp + 0xc], 0
je 0x4538fe
cmp dword [ebp - 0x28], 8
lea ecx, [ebp - 0x48]
push ecx
push 1
lea eax, [ebp - 0x3c]
cmovae eax, dword [ebp - 0x3c]
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4538fe
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x14
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push str.CurrentVersion
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test edi, edi
je 0x4538a5
mov edx, edi
lea ecx, [ebp - 0x24]
call fcn.00453ae0
test al, al
je 0x4538fe
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x4538fe
mov edx, dword [ebp - 0x4c]
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call fcn.004535e0
add esp, 4
test eax, eax
je 0x4538fe
mov ebx, dword [ebp - 0x54]
test ebx, ebx
je 0x4538d9
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
call fcn.00402140
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x28], 8
jb 0x4538f1
push dword [ebp - 0x3c]
call fcn.00494c0b
add esp, 4
mov eax, dword [ebp - 0x4c]
cmp dword [eax + 0x10], 0
jbe 0x453916
mov al, 1
jmp 0x45392c
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x28], 8
jb 0x453916
push dword [ebp - 0x3c]
call fcn.00494c0b
add esp, 4
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp eax, 6
jge 0x45392a
mov ebx, dword [ebp - 0x54]
jmp 0x4537b6
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00494c10
mov esp, ebp
pop ebp
ret
Function at 0x455780
Capabilities:
Set current directory
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6548
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x510620]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, str.LOCALAPPDATA
lea ecx, [ebp - 0x2c]
call fcn.00463a60
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
jne 0x455818
mov edx, str.USERPROFILE
lea ecx, [ebp - 0x48]
call fcn.00463a60
mov byte [ebp - 4], 1
test eax, eax
je 0x4557e3
add eax, 4
lea ecx, [ebp - 0x28]
cmp ecx, eax
je 0x4557f2
jmp 0x4557e5
xor eax, eax
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x28]
call fcn.00402990
mov byte [ebp - 4], 0
cmp dword [ebp - 0x30], 8
mov dword [ebp - 0x48], vtable.UString.0
jb 0x45580e
push dword [ebp - 0x44]
call fcn.00494c0b
add esp, 4
cmp dword [ebp - 0x18], 0
je 0x455909
push 8
push str.uclient
lea ecx, [ebp - 0x28]
call fcn.00406030
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
call fcn.00462220
test al, al
jne 0x455851
mov edx, 0x10
mov ecx, 0x4ecb54
call fcn.0046faa0
push 3
call fcn.0049a286
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x64]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00455d60
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 2
push eax
mov ecx, 0x5118a0
call fcn.00402990
mov byte [ebp - 4], 0
cmp dword [ebp - 0x4c], 8
mov dword [ebp - 0x64], vtable.UString.0
jb 0x455897
push dword [ebp - 0x60]
call fcn.00494c0b
add esp, 4
push str._temp
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x44]
call fcn.00406890
add esp, 4
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 8
jb 0x4558b6
mov eax, dword [eax]
mov ecx, eax
call fcn.00462220
mov byte [ebp - 4], 0
cmp dword [ebp - 0x30], 8
jb 0x4558d2
push dword [ebp - 0x44]
call fcn.00494c0b
add esp, 4
push str._tempdownloads
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x44]
call fcn.00406890
add esp, 4
mov byte [ebp - 4], 4
cmp dword [eax + 0x14], 8
jb 0x4558f1
mov eax, dword [eax]
mov ecx, eax
call fcn.00462220
cmp dword [ebp - 0x30], 8
jb 0x455909
push dword [ebp - 0x44]
call fcn.00494c0b
add esp, 4
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp dword [ebp - 0x14], 8
mov dword [ebp - 0x2c], vtable.UString.0
jb 0x455933
push dword [ebp - 0x28]
call fcn.00494c0b
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00494c10
mov esp, ebp
pop ebp
ret
Function at 0x4559d0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d657b
mov eax, dword fs:[0]
push eax
sub esp, 0x45c
mov eax, dword [0x510620]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [0x51afd4]
mov dword [ebp - 0x448], 0
test al, 1
jne 0x455a4e
or eax, 1
mov dword [0x51aff0], 7
mov dword [0x51afd4], eax
xor eax, eax
push 0x4dbbe0
mov dword [0x51afec], 0
mov word [0x51afdc], ax
mov dword [0x51afd8], 0x4e7088
call fcn.004957fd
add esp, 4
cmp dword [0x51afec], 0
jne 0x455b9e
push 0x104
lea eax, [ebp - 0x230]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0
push eax
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
je 0x455b9e
push esi
call fcn.0047d9ae
add esp, 4
mov edi, eax
lea eax, [ebp - 0x230]
push edi
push esi
push 0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x455b95
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x444]
push eax
push str.VarFileInfoTranslation
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x455b95
mov eax, dword [ebp - 0x444]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
movzx ecx, word [eax]
movzx eax, word [eax + 2]
shl ecx, 0x10
or ecx, eax
lea eax, [ebp - 0x24]
push ecx
push str._08x
push eax
call esi
push 0x4eaea4
lea eax, [ebp - 0x24]
mov dword [ebp - 0x440], 0
push eax
lea eax, [ebp - 0x430]
push str.StringFileInfo_s_s
push eax
call esi
add esp, 0x1c
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x430]
push eax
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
push dword [ebp - 0x440]
lea ecx, [ebp - 0x464]
call fcn.00455d60
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x460]
mov dword [ebp - 4], 0
push eax
mov ecx, 0x51afdc
call fcn.00402990
lea ecx, [ebp - 0x464]
mov dword [ebp - 4], 0xffffffff
call fcn.00416900
push ecx
push 0x4e4f80
push 0x4e7d44
mov ecx, 0x51afd8
call fcn.00456160
push edi
call fcn.00495300
add esp, 4
xor eax, eax
mov dword [ebx + 0x18], 7
push 0xffffffffffffffff
lea ecx, [ebx + 4]
mov dword [ecx + 0x10], 0
push eax
push 0x51afdc
mov word [ecx], ax
call fcn.00402990
mov dword [ebx], vtable.UString.0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00494c10
mov esp, ebp
pop ebp
ret