joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4572c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x4b31cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
lea edx, [ebp - 0x50]
mov ecx, dword [ebp + 0xc]
xorps xmm0, xmm0
push edi
mov edi, dword [ebp + 8]
push edx
lea edx, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push edx
push 0
push 0
push eax
push ecx
movdqu xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x50], 0x2c
movdqu xmmword [ebp - 0x1c], xmm0
movq qword [ebp - 0xc], xmm0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x457448
cmp dword [ebp - 0x30], 0x2c
jne 0x457448
push ebx
push esi
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ebx, eax
mov eax, dword [ebp - 0x28]
sub eax, 2
je 0x457346
dec eax
jne 0x45735c
and ebx, 0xdfffffff
or ebx, 0x1000000
jmp 0x457352
and ebx, 0xfeffffff
or ebx, 0x20000000
push ebx
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
lea eax, [ebp - 0x40]
shr ebx, 0x12
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [ebp - 0x14]
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x40]
and bl, 1
je 0x457388
mov ecx, edx
sub ecx, eax
mov eax, dword [ebp - 0xc]
sub eax, esi
cmp eax, ecx
jge 0x45738f
mov eax, dword [ebp - 0x40]
sub edx, eax
add edx, esi
mov dword [ebp - 0xc], edx
mov esi, dword [ebp - 0x10]
test bl, bl
mov edx, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x3c]
je 0x4573a9
mov eax, dword [ebp - 8]
mov ecx, edx
sub ecx, ebx
sub eax, esi
cmp eax, ecx
jge 0x4573b0
sub edx, ebx
add edx, esi
mov dword [ebp - 8], edx
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x4c
call esi
push 0x4d
mov dword [ebp - 0x4c], eax
call esi
push 0x4e
mov dword [ebp - 0x44], eax
call esi
push 0x4c
mov ebx, eax
call esi
push 0x4f
add ebx, eax
call esi
push 0x4d
mov dword [ebp - 0x48], eax
call esi
mov ecx, dword [ebp - 0x48]
mov esi, dword [sym.imp.USER32.dll_OffsetRect]
add ecx, eax
mov eax, dword [ebp - 8]
cmp eax, ecx
jle 0x4573f8
sub ecx, eax
lea eax, [ebp - 0x14]
push ecx
push 0
push eax
call esi
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
jge 0x45740d
sub eax, ecx
push eax
push 0
lea eax, [ebp - 0x14]
push eax
call esi
mov eax, dword [ebp - 0xc]
cmp eax, ebx
jle 0x45741f
push 0
sub ebx, eax
lea eax, [ebp - 0x14]
push ebx
push eax
call esi
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
jge 0x457434
push 0
sub eax, ecx
push eax
lea eax, [ebp - 0x14]
push eax
call esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x28], 0
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowPlacement]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0046dfbe
mov esp, ebp
pop ebp
ret
Function at 0x4612f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x489d50
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4b31cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x2c], ebx
cmp byte [ebp + 0xc], 0
mov eax, dword [ebp + 8]
je 0x461334
movdqu xmm0, xmmword [eax]
movdqu xmmword [ebp - 0x20], xmm0
jmp 0x46134d
mov eax, dword [eax]
xorps xmm0, xmm0
mov dword [ebp - 0x20], eax
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
movdqu xmm0, xmmword [ebp - 0x20]
push ebx
movdqu xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x38], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add ebx, 0x1c
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x30], ebx
push eax
mov ecx, ebx
call fcn.00462230
mov ecx, dword [ebx]
cmp eax, ecx
je 0x4613cd
lea edi, [eax + 0x10]
mov ebx, 0xc
lea esi, [ebp - 0x20]
mov edx, dword [esi]
cmp edx, dword [edi]
jne 0x46139a
add esi, 4
add edi, 4
sub ebx, 4
jae 0x461385
xor ebx, ebx
jmp 0x4613c6
movzx ebx, dl
movzx edx, byte [edi]
sub ebx, edx
jne 0x4613c6
movzx ebx, byte [esi + 1]
movzx edx, byte [edi + 1]
sub ebx, edx
jne 0x4613c6
movzx ebx, byte [esi + 2]
movzx edx, byte [edi + 2]
sub ebx, edx
jne 0x4613c6
movzx ebx, byte [esi + 3]
movzx edx, byte [edi + 3]
sub ebx, edx
mov dword [ebp - 0x28], eax
test ebx, ebx
jns 0x4613d0
mov dword [ebp - 0x28], ecx
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x28]
mov eax, dword [eax]
cmp eax, dword [esi]
je 0x4613f9
lea ecx, [eax + 0x20]
call fcn.00468f70
push dword [ebp - 0x2c]
test eax, eax
setne bl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
jmp 0x4614ae
movdqu xmm0, xmmword [ebp - 0x4c]
push 0x48cc00
movdqu xmmword [ebp - 0x24], xmm0
call fcn.00468d70
push eax
push 0x48cc00
call fcn.00468f00
add esp, 0xc
mov dword [ebp - 0x14], eax
movzx eax, byte [0x4ba538]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 1
push eax
push 0
lea eax, [ebp - 0x34]
push eax
call fcn.00461070
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0
test ecx, ecx
je 0x46144b
call fcn.00468f40
mov edi, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x2c]
add edi, 0x20
push ebx
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x1c
call fcn.0046d6f6
add esp, 4
lea ecx, [ebx + 0x18]
mov esi, eax
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov al, byte [ebp + 0xc]
movdqu xmm0, xmmword [ebp - 0x4c]
mov byte [esi + 0x14], al
lea eax, [ebp - 0x3c]
push eax
push 0
push esi
push 0x461650
push 0
push 0
mov dword [esi], ebx
movdqu xmmword [esi + 4], xmm0
mov dword [esi + 0x18], edi
call fcn.00470f30
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046dfbe
mov esp, ebp
pop ebp
ret 8
Function at 0x4614d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x489d90
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4b31cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
movzx esi, byte [ebp + 0xc]
movzx eax, word [ebp + 8]
shl esi, 0x10
push ebx
or esi, eax
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 0x1c]
mov edx, eax
mov dword [ebp - 4], 0
mov ecx, dword [eax + 4]
cmp byte [ecx + 0xd], 0
jne 0x461544
lea esp, [esp]
cmp dword [ecx + 0x10], esi
jae 0x46153a
mov ecx, dword [ecx + 8]
jmp 0x46153e
mov edx, ecx
mov ecx, dword [ecx]
cmp byte [ecx + 0xd], 0
je 0x461530
cmp edx, eax
je 0x461550
mov dword [ebp - 0x10], edx
cmp esi, dword [edx + 0x10]
jae 0x461553
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
mov eax, dword [eax]
cmp eax, dword [ebx + 0x1c]
je 0x461589
lea ecx, [eax + 0x14]
call fcn.00468f70
push dword [ebp - 0x18]
test eax, eax
setne bl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x48cc00
mov dword [ebp - 0x1c], esi
call fcn.00468d70
push eax
push 0x48cc00
call fcn.00468f00
mov esi, eax
add esp, 0xc
mov dword [ebp - 0x18], esi
movzx edx, byte [0x4ba538]
lea eax, [ebp - 0x1c]
push edx
push eax
push 0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebx + 0x1c]
call fcn.00460f60
mov byte [ebp - 4], 0
test esi, esi
je 0x4615d6
mov ecx, esi
call fcn.00468f40
mov edi, dword [ebp - 0x14]
push ebx
add edi, 0x14
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0xc
call fcn.0046d6f6
add esp, 4
lea ecx, [ebx + 0x18]
mov esi, eax
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ax, word [ebp + 8]
mov word [esi + 4], ax
mov al, byte [ebp + 0xc]
mov byte [esi + 6], al
lea eax, [ebp - 0x24]
push eax
push 0
push esi
push 0x461860
push 0
push 0
mov dword [esi], ebx
mov dword [esi + 8], edi
call fcn.00470f30
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x462f10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4b31cc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4ba4e8], 0
mov dword [ebp - 0x230], 0x49fc28
mov dword [ebp - 0x22c], 0x462a20
mov dword [ebp - 0x228], 0x49fc34
mov dword [ebp - 0x224], 0x462cc0
mov dword [ebp - 0x220], 0x49fc40
mov dword [ebp - 0x21c], fcn.004629d0
jne 0x463092
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x463088
push ebx
push esi
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.00471955
push 0x49fc50
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.004719aa
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test edi, edi
je 0x462fe8
push 0x49fc28
push edi
call ebx
test eax, eax
jne 0x46303d
push edi
call esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.00471955
push 0x49fc58
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.004719aa
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x463085
push 0x49fc28
push edi
call ebx
test eax, eax
jne 0x46303d
push edi
call esi
jmp 0x463085
xor esi, esi
nop
push dword [ebp + esi*8 - 0x230]
push edi
call ebx
mov dword [ebp + esi*8 - 0x22c], eax
test eax, eax
je 0x46307e
inc esi
cmp esi, 3
jl 0x463040
mov eax, dword [ebp - 0x22c]
mov dword [0x4b318c], eax
mov eax, dword [ebp - 0x224]
mov dword [0x4b3194], eax
mov eax, dword [ebp - 0x21c]
mov dword [fcn.004629d0], eax
jmp 0x463085
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
mov dword [0x4ba4e8], 1
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
movzx eax, ax
xor ecx, ebp
mov eax, dword [eax*8 + 0x4b318c]
call fcn.0046dfbe
mov esp, ebp
pop ebp
ret 4
Function at 0x463320
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
push ebx
push edi
mov edi, dword [ebp + 0x1c]
push dword [ebp + 8]
mov dword [edi], 0
mov byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x4633ae
cmp word [ebx + 8], 2
push esi
jne 0x463382
cmp word [ebx + 0xa], 4
jne 0x463382
mov esi, dword [ebx + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x463382
jmp 0x463360
push dword [eax]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00463250
mov dword [edi], eax
test eax, eax
je 0x4633a2
add esi, 4
lea edi, [eax + 0x1c]
mov eax, dword [esi]
test eax, eax
jne 0x463360
push 0x400
push dword [ebx]
push 0x401
push dword [ebp + 0x18]
call fcn.00471a0d
add esp, 0x10
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
pop esi
pop edi
mov eax, 8
pop ebx
pop ebp
ret 0x18
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x4633be.11001
jmp dword [eax*4 + 0x4633e8]
pop edi
mov eax, 0x2af9
pop ebx
pop ebp
ret 0x18
pop edi
mov eax, 0x2afa
pop ebx
pop ebp
ret 0x18
pop edi
mov eax, 0x2afb
pop ebx
pop ebp
ret 0x18

Function at 0x463a60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
mov eax, dword [edi]
test eax, eax
je 0x463acd
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push ecx
push 0
push 0
push 0
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x463aea
push esi
push dword [ebp - 4]
call fcn.0046d699
add esp, 4
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
push 0
push 0
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
push esi
call fcn.00468d10
push esi
call fcn.0046e86a
add esp, 4
mov al, 1
pop esi
pop edi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 4]
test eax, eax
je 0x463aea
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call fcn.004636c0
add esp, 0xc
pop edi
mov esp, ebp
pop ebp
ret 8
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 8
Function at 0x463b00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4841a8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4b31cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ecx]
test eax, eax
je 0x463b5a
lea ecx, [ebp + 0x10]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 4]
test eax, eax
je 0x463bf8
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
push ecx
push dword [ebp + 8]
push eax
call fcn.004636c0
mov esi, dword [ebp - 0x10]
add esp, 0xc
test al, al
je 0x463bce
test esi, esi
je 0x463bb9
mov ecx, esi
call fcn.00468f60
mov esi, dword [ebp - 0x10]
mov edi, eax
test esi, esi
je 0x463bbb
mov ecx, esi
call fcn.00468e60
mov esi, dword [ebp - 0x10]
push edi
push eax
push dword [ebp + 0xc]
call fcn.0046ea20
add esp, 0xc
mov bl, 1
jmp 0x463bd0
xor edi, edi
xor eax, eax
push edi
push eax
push dword [ebp + 0xc]
call fcn.0046ea20
add esp, 0xc
mov bl, 1
jmp 0x463bd0
xor bl, bl
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x463be2
mov ecx, esi
call fcn.00468f40
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x464570
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
je 0x4645be
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi]
test ecx, ecx
je 0x46458f
call fcn.00468f60
mov ebx, eax
jmp 0x464591
xor ebx, ebx
mov ecx, dword [edi]
test ecx, ecx
je 0x46459e
call fcn.00468e60
jmp 0x4645a0
xor eax, eax
push ebx
push eax
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
pop edi
sbb eax, eax
pop esi
inc eax
pop ebx
pop ebp
ret 0xc
cmp dword [esi + 4], 0
je 0x4645fe
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi]
test ecx, ecx
je 0x4645d6
call fcn.00468f60
mov ebx, eax
jmp 0x4645d8
xor ebx, ebx
mov ecx, dword [edi]
test ecx, ecx
je 0x4645e5
call fcn.00468e60
jmp 0x4645e7
xor eax, eax
push ebx
push eax
push dword [ebp + 8]
push dword [esi + 4]
call fcn.00463790
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 0xc
Function at 0x464610
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov ecx, edx
push esi
lea esi, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x464620
mov eax, dword [ebp + 8]
sub ecx, esi
sar ecx, 1
add ecx, ecx
mov esi, dword [eax]
test esi, esi
je 0x464652
push ecx
push edx
push 1
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
pop esi
sete al
pop ebp
ret
mov eax, dword [eax + 4]
test eax, eax
je 0x46466a
push ecx
push edx
push dword [ebp + 0xc]
push eax
call fcn.00463790
add esp, 0x10
pop esi
pop ebp
ret
xor al, al
pop esi
pop ebp
ret

Function at 0x4647d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
cwde
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
test ecx, ecx
je 0x4647fe
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
pop ebp
ret
mov eax, dword [eax + 4]
test eax, eax
je 0x464819
push 4
lea ecx, [ebp + 0x10]
push ecx
push dword [ebp + 0xc]
push eax
call fcn.00463790
add esp, 0x10
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x464820
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
test ecx, ecx
je 0x464847
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
pop ebp
ret
mov eax, dword [eax + 4]
test eax, eax
je 0x464862
push 4
lea ecx, [ebp + 0x10]
push ecx
push dword [ebp + 0xc]
push eax
call fcn.00463790
add esp, 0x10
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x464870
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
test ecx, ecx
je 0x464897
push 8
lea eax, [ebp + 0x10]
push eax
push 3
push 0
push dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
pop ebp
ret
mov eax, dword [eax + 4]
test eax, eax
je 0x4648b2
push 8
lea ecx, [ebp + 0x10]
push ecx
push dword [ebp + 0xc]
push eax
call fcn.00463790
add esp, 0x10
pop ebp
ret
xor al, al
pop ebp
ret
Function at 0x4648c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x4b31cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x5c]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push 0x58
push 0
push eax
mov dword [ebp - 0x60], 0
call fcn.0046e870
add esp, 0xc
lea eax, [ebp - 0x60]
push eax
push 0x5c
push esi
call dword [sym.imp.GDI32.dll_GetObjectW]
push dword [0x4b4858]
push 0x48
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
mov dword [ebp - 0x60], eax
mov eax, dword [edi]
test eax, eax
je 0x464944
push 0x5c
lea ecx, [ebp - 0x60]
push ecx
push 3
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
test eax, eax
pop esi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046dfbe
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 4]
test eax, eax
je 0x46496c
push 0x5c
lea ecx, [ebp - 0x60]
push ecx
push ebx
push eax
call fcn.00463790
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046dfbe
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046dfbe
mov esp, ebp
pop ebp
ret

Function at 0x464980
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
movzx eax, al
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
test ecx, ecx
je 0x4649b0
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
pop ebp
ret
mov eax, dword [eax + 4]
test eax, eax
je 0x4649cb
push 4
lea ecx, [ebp + 0x10]
push ecx
push dword [ebp + 0xc]
push eax
call fcn.00463790
add esp, 0x10
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x4649d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
test ecx, ecx
je 0x4649f4
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 3
push 0
push dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov al, 1
pop ebp
ret
mov eax, dword [eax + 4]
test eax, eax
je 0x464a0d
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.00463790
add esp, 0x10
mov al, 1
pop ebp
ret
Function at 0x464a20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4b31cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
lea ebx, [edi + edi]
mov eax, ebx
mov dword [ebp - 0xc], ebx
call fcn.00471d60
mov eax, esp
mov dword [ebp - 8], eax
test edi, edi
je 0x464a75
mov ebx, dword [ebp + 0x10]
mov esi, eax
sub ebx, eax
push dword [0x4b4854]
movzx eax, word [ebx + esi]
push 0x60
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov word [esi], ax
lea esi, [esi + 2]
dec edi
jne 0x464a53
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
test edx, edx
je 0x464a90
push ebx
push eax
push 3
push 0
push dword [ebp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x464aa5
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x464aa5
push ebx
push eax
push dword [ebp + 0xc]
push ecx
call fcn.00463790
add esp, 0x10
mov al, 1
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046dfbe
mov esp, ebp
pop ebp
ret
Function at 0x464f70
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48a1cc
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4b31cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 5
push eax
call fcn.00466390
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.004677d0
cmp byte [ebx + 0x578], 0
je 0x464fdc
lea ecx, [ebp - 0x10]
call fcn.00468f70
test eax, eax
je 0x464fdc
lea ecx, [ebp - 0x10]
call fcn.004689b0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebx + 0x57c]
mov ecx, dword [eax]
mov dword [eax], eax
mov eax, dword [ebx + 0x57c]
mov dword [eax + 4], eax
mov dword [ebx + 0x580], 0
cmp ecx, dword [ebx + 0x57c]
je 0x465016
mov esi, dword [ecx]
push ecx
call fcn.0046d747
add esp, 4
mov ecx, esi
cmp esi, dword [ebx + 0x57c]
jne 0x465001
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 5
test ecx, ecx
je 0x465026
call fcn.00468f40
mov eax, dword [ebx + 0x57c]
mov ecx, dword [eax]
mov dword [eax], eax
mov eax, dword [ebx + 0x57c]
mov dword [eax + 4], eax
mov dword [ebx + 0x580], 0
cmp ecx, dword [ebx + 0x57c]
je 0x465065
jmp 0x465050
mov esi, dword [ecx]
push ecx
call fcn.0046d747
add esp, 4
mov ecx, esi
cmp esi, dword [ebx + 0x57c]
jne 0x465050
push dword [ebx + 0x57c]
call fcn.0046d747
mov eax, dword [ebx + 0x56c]
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x465096
push 0x4000
lea eax, [eax + eax*4]
push eax
push dword [ebx + 0x560]
call esi
jmp 0x4650ae
push dword [ebx + 0x560]
call fcn.0046e94b
add esp, 4
mov dword [ebx + 0x560], 0
cmp dword [ebx + 0x56c], 0
mov dword [ebx + 0x564], 0
mov dword [ebx + 0x568], 0
je 0x4650da
push 0x8000
push 0
push dword [ebx + 0x560]
call esi
lea ecx, [ebx + 0x514]
mov byte [ebp - 4], 2
call fcn.00414fe0
mov eax, dword [ebx + 0x4fc]
lea edi, [ebx + 0x4e4]
push eax
lea ecx, [edi + 0x18]
push dword [eax]
lea eax, [ebp - 0x18]
push eax
call fcn.0045c1a0
push dword [edi + 0x18]
call fcn.0046d747
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea ecx, [ebx + 0x4b0]
mov byte [ebp - 4], 0
call fcn.0040d600
lea ecx, [ebx + 0x3a8]
mov dword [ebp - 4], 0xffffffff
call fcn.00415080
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret