joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447863
Capabilities:
Set registry value

Disassembly:
push 0x220
mov eax, 0x4b275c
call fcn.00468fdc
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov esi, eax
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x22c], esi
push ebx
push eax
call fcn.00481750
push 0xa
push 0x104
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.0048865e
add esp, 0x1c
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x220]
push eax
call fcn.00402829
push str.Server_to_set_iNotify_value_in_HKEY_CURRENT_USER:
lea ecx, [ebp - 0x224]
mov dword [ebp - 4], ebx
call fcn.00402829
push ebx
lea eax, [ebp - 0x220]
mov byte [ebp - 4], 1
push eax
push 2
lea edx, [ebp - 0x224]
pop ecx
call fcn.004130a0
pop ecx
pop ecx
mov ecx, dword [ebp - 0x224]
lea ecx, [ecx - 0x10]
call fcn.00402e64
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.00402e64
lea eax, [ebp - 0x21c]
mov edi, 0x4ca238
push eax
push edi
mov esi, SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x21c]
push eax
push 0xf003f
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4479b4
push 4
lea eax, [ebp - 0x22c]
push eax
push 4
push ebx
push str.iNotify
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x21c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4479e9
push str.Server__RegSetValueEx__failed_to_set_iNotify_value_in_HKEY_CURRENT_USER
lea ecx, [ebp - 0x220]
call fcn.00402829
push ebx
push 2
lea edx, [ebp - 0x220]
mov dword [ebp - 4], 2
pop ecx
call fcn.004137d1
pop ecx
mov ecx, dword [ebp - 0x220]
jmp 0x4479e1
push str.Server__RegOpenKeyEx__failed_to_set_iNotify_value_in_HKEY_CURRENT_USER
lea ecx, [ebp - 0x228]
call fcn.00402829
push ebx
push 2
lea edx, [ebp - 0x228]
mov dword [ebp - 4], 3
pop ecx
call fcn.004137d1
pop ecx
mov ecx, dword [ebp - 0x228]
lea ecx, [ecx - 0x10]
call fcn.00402e64
call fcn.00468f86
ret
Function at 0x4488c9
Capabilities:
Get common file path

Disassembly:
push 0x218
mov eax, 0x4b2a6c
call fcn.00468fdc
push str.CleanupUpgradeCache...
lea ecx, [ebp - 0x21c]
call fcn.00402829
xor edi, edi
lea edx, [ebp - 0x21c]
push edi
push 2
pop ebx
mov ecx, ebx
mov dword [ebp - 4], edi
call fcn.004137d1
or dword [ebp - 4], 0xffffffff
pop ecx
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.00402e64
lea eax, [ebp - 0x218]
push eax
push edi
push edi
push 0x8023
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
jns 0x448967
push str.SHGetFolderPath_failed
lea ecx, [ebp - 0x21c]
call fcn.00402829
push esi
lea edx, [ebp - 0x21c]
mov dword [ebp - 4], 1
mov ecx, ebx
call fcn.00413882
pop ecx
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov eax, esi
jmp 0x448a07
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x220]
call fcn.00402829
push 0x514ecc
lea eax, [ebp - 0x224]
mov dword [ebp - 4], ebx
push str.AdobeARMUpgradeCache_
push eax
call fcn.004023f1
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x220]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.004025c6
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.00402e64
push ecx
mov esi, esp
mov dword [ebp - 0x224], esi
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
push eax
call fcn.00402d9f
pop ecx
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.00444a81
push dword [0x514d20]
mov edx, 0x4ca238
mov ecx, SysReAllocString
call fcn.0043fda3
pop ecx
pop ecx
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.00402e64
xor eax, eax
call fcn.00468f86
ret
Function at 0x449a2e
Capabilities:
Download url
Receive data

Disassembly:
push 0x5c
mov eax, 0x4b2df0
call fcn.00468fdc
mov esi, edx
mov dword [ebp - 0x68], esi
mov ebx, ecx
mov dword [ebp - 0x64], ebx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x54]
and dword [ebp - 0x54], 0
push ecx
push 0x4c9020
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x5c], eax
push ecx
mov ecx, eax
call fcn.00429c56
and dword [ebp - 4], 0
jmp 0x449c09
mov eax, dword [esi]
sub eax, 0x10
push eax
call fcn.00402d9f
add eax, 0x10
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x40]
mov dword [esp], str..txt
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00402459
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.004025c6
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x58]
lea ecx, [ecx - 0x10]
call fcn.00402e64
push str.ping__URL:
lea ecx, [ebp - 0x48]
call fcn.00402829
push ecx
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 3
push eax
lea edx, [ebp - 0x48]
call fcn.0041384b
pop ecx
pop ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x48]
lea ecx, [ecx - 0x10]
call fcn.00402e64
push 0
call fcn.00487ace
push eax
call fcn.00487a39
call fcn.00487a18
push 0xa
mov edx, eax
lea edi, [ebp - 0x38]
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push 0xa
lea eax, [ebp - 0x38]
push eax
push edx
call fcn.00488629
mov eax, dword [ebx]
sub eax, 0x10
push eax
call fcn.00402d9f
add eax, 0x10
add esp, 0x18
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040259d
push str._arm.txt
lea ecx, [ebp - 0x3c]
call fcn.0040259d
push str.temp_file_path:
lea ecx, [ebp - 0x4c]
call fcn.00402829
mov byte [ebp - 4], 5
lea eax, [ebp - 0x3c]
push ecx
push eax
lea edx, [ebp - 0x4c]
call fcn.0041384b
pop ecx
pop ecx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x4c]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov edi, dword [ebp - 0x44]
push edi
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
mov esi, dword [ebp - 0x3c]
xor eax, eax
push eax
push eax
push esi
push edi
push eax
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
push str.ping__result:
lea ecx, [ebp - 0x50]
mov ebx, eax
call fcn.00402829
push ebx
push 2
lea edx, [ebp - 0x50]
mov byte [ebp - 4], 6
pop ecx
call fcn.00413882
pop ecx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x50]
lea ecx, [ecx - 0x10]
call fcn.00402e64
lea ecx, [ebp - 0x3c]
call fcn.00444c53
mov ecx, dword [ebp - 0x5c]
lea eax, [ebp - 0x54]
push eax
push 0x4c9020
lea eax, [ebp - 0x60]
push eax
call fcn.00429c56
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 7
call fcn.00402e14
mov ecx, dword [ebp - 0x60]
lea ecx, [ecx - 0x10]
call fcn.00402e64
lea ecx, [esi - 0x10]
call fcn.00402e64
lea ecx, [edi - 0x10]
mov byte [ebp - 4], 0
call fcn.00402e64
mov ebx, dword [ebp - 0x64]
mov esi, dword [ebp - 0x68]
mov eax, dword [ebp - 0x40]
cmp dword [eax - 0xc], 0
jne 0x449a6b
lea ecx, [eax - 0x10]
call fcn.00402e64
xor eax, eax
call fcn.00468f86
ret
Function at 0x44aed7
Capabilities:
Query environment variable

Disassembly:
push 8
mov eax, 0x4b31b8
call fcn.00468fa8
mov ebx, edx
mov edi, ecx
push str.Entered_ExtractPath:
lea ecx, [ebp - 0x10]
call fcn.00402829
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push ecx
push edi
call fcn.0041384b
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov eax, dword [edi]
sub eax, 0x10
push eax
call fcn.00402d9f
add eax, 0x10
pop ecx
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 1
call fcn.00423864
push 0
push str..exe
lea ecx, [ebp - 0x10]
call fcn.0040944e
mov esi, eax
cmp esi, 0xffffffff
je 0x44b051
push str.found_EXE_value_in:
lea ecx, [ebp - 0x14]
call fcn.00402829
push ecx
push edi
lea edx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.0041384b
pop ecx
pop ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00402e64
cmp dword [ebp + 8], 1
jne 0x44afce
push 0
push 0x4f6a68
lea ecx, [ebp - 0x10]
call fcn.0040944e
cmp eax, 0xffffffff
je 0x44afbb
cmp eax, esi
jge 0x44afbb
sub esi, eax
mov ecx, edi
add esi, 4
push esi
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00414392
push eax
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.00402e14
jmp 0x44b046
push str.Could_not_extract_app_path_from:
lea ecx, [ebp - 0x14]
call fcn.00402829
mov byte [ebp - 4], 4
jmp 0x44b03a
cmp dword [ebp + 8], 2
jne 0x44b051
push 0
push 0x4f6ab4
lea ecx, [ebp - 0x10]
call fcn.0040944e
cmp eax, 0xffffffff
je 0x44b029
cmp eax, esi
jge 0x44b029
sub esi, eax
mov ecx, edi
add esi, 4
push esi
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00414392
mov esi, 0x104
mov byte [ebp - 4], 5
push esi
mov ecx, ebx
call fcn.00402bd2
push esi
mov esi, dword [ebp - 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0xffffffffffffffff
mov ecx, ebx
call fcn.00409889
lea ecx, [esi - 0x10]
jmp 0x44b04c
push str.Could_not_extract_app_path_from:
lea ecx, [ebp - 0x14]
call fcn.00402829
mov byte [ebp - 4], 6
push ecx
push edi
lea edx, [ebp - 0x14]
call fcn.0041384b
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00402e64
call fcn.00468f71
ret
Function at 0x44b062
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
push 0x20
mov eax, 0x4b3208
call fcn.00468fa8
lea eax, [ebp - 0x20]
push eax
push 0x20019
push 0
push dword [ecx]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x44b091
xor al, al
jmp 0x44b202
call fcn.0044f181
push eax
lea ecx, [ebp - 0x24]
call fcn.00402899
and dword [ebp - 4], 0
call fcn.0044f181
push eax
lea ecx, [ebp - 0x14]
call fcn.00402899
xor ebx, ebx
mov esi, 0x400
inc ebx
mov eax, esi
mov byte [ebp - 4], bl
xor edi, edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], eax
cmp edi, 0x32
jge 0x44b1df
push eax
lea ecx, [ebp - 0x14]
call fcn.00402bd2
push dword [ebp - 0x18]
lea ecx, [ebp - 0x24]
mov esi, eax
call fcn.00402bd2
lea ecx, [ebp - 0x1c]
push ecx
push esi
lea ecx, [ebp - 0x2c]
push ecx
push 0
lea ecx, [ebp - 0x18]
push ecx
push eax
push edi
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x44b1df
push 0xffffffffffffffff
lea ecx, [ebp - 0x24]
call fcn.00409889
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.00409889
call fcn.0044f181
push eax
lea ecx, [ebp - 0x10]
call fcn.00402899
mov byte [ebp - 4], 2
lea edx, [ebp - 0x10]
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x14]
call fcn.0044aed7
mov eax, dword [ebp - 0x10]
pop ecx
cmp dword [eax - 0xc], 0
je 0x44b151
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44b19e
push str.App_for_.pdf_progID_not_found:
lea ecx, [ebp - 0x28]
call fcn.00402829
push ecx
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 4
push eax
lea edx, [ebp - 0x28]
call fcn.0041384b
pop ecx
pop ecx
mov ecx, dword [ebp - 0x28]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov byte [ebp - 4], bl
mov eax, 0x400
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov eax, dword [ebp - 0x1c]
inc edi
jmp 0x44b0c6
push 0x4f6ab8
lea ecx, [ebp - 0x28]
call fcn.00402829
push ecx
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 3
push eax
lea edx, [ebp - 0x28]
call fcn.0041384b
pop ecx
pop ecx
mov ecx, dword [ebp - 0x28]
lea ecx, [ecx - 0x10]
call fcn.00402e64
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00402e64
jmp 0x44b1ea
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor bl, bl
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00402e64
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00402e64
mov al, bl
call fcn.00468f71
ret
Function at 0x44b208
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x22c
mov eax, 0x4b325c
call fcn.00468fdc
mov edi, ecx
push str.Entered_EnumKeys:
lea ecx, [ebp - 0x228]
call fcn.00402829
push ecx
xor ebx, ebx
lea edx, [ebp - 0x228]
push edi
mov dword [ebp - 4], ebx
call fcn.0041384b
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
mov ecx, dword [ebp - 0x228]
lea ecx, [ecx - 0x10]
call fcn.00402e64
lea eax, [ebp - 0x21c]
push eax
push 8
push ebx
push dword [edi]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44b3b6
mov esi, ebx
cmp esi, 0x32
jae 0x44b3aa
push 0x208
lea eax, [ebp - 0x218]
xorps xmm0, xmm0
push ebx
push eax
movlpd qword [ebp - 0x238], xmm0
call fcn.00481750
add esp, 0xc
mov dword [ebp - 0x22c], 0x104
lea eax, [ebp - 0x238]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x44b3aa
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x224]
call fcn.00402829
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x224]
cmp dword [eax - 0xc], 0
je 0x44b36c
push 0x4cc6b0
lea eax, [ebp - 0x230]
push edi
push eax
call fcn.00402459
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 2
push ecx
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.004024b8
add esp, 0x18
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x230]
lea ecx, [ecx - 0x10]
call fcn.00402e64
lea ecx, [ebp - 0x220]
call fcn.0044b062
mov bl, al
test bl, bl
jne 0x44b37e
lea ecx, [ebp - 0x220]
call fcn.0044b208
mov bl, al
test bl, bl
jne 0x44b37e
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov eax, dword [ebp - 0x224]
xor ebx, ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [eax - 0x10]
call fcn.00402e64
inc esi
jmp 0x44b270
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov ecx, dword [ebp - 0x224]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov al, bl
jmp 0x44b3b8
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
call fcn.00468f86
ret
Function at 0x44b3be
Capabilities:
Check if file exists
Download url
Get file attributes
Receive data

Disassembly:
push 0x14
mov eax, 0x4b32d8
call fcn.00468fa8
mov ebx, ecx
mov dword [ebp - 0x18], ebx
push str.PingPdfExtension:
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 1
call fcn.00402829
push 0
lea edx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00413819
pop ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov byte [ebx], 0
call fcn.0044f181
push eax
lea ecx, [ebp - 0x10]
call fcn.00402899
mov byte [ebp - 4], 3
call fcn.0044f181
push eax
lea ecx, [ebp - 0x14]
call fcn.00402899
lea edx, [ebp - 0x14]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x10]
call fcn.00440e68
test eax, eax
jne 0x44b448
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
add esi, 0xfffffff0
add ecx, 0xfffffff0
jmp 0x44b561
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
push dword [eax - 0xc]
push eax
call fcn.004025c6
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
mov edi, dword [ebp - 0x14]
push edi
mov eax, dword [eax - 0xc]
add eax, 0xfffffffc
push eax
call fcn.0040960f
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004024b8
add esp, 0xc
mov byte [ebp - 4], 5
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
mov esi, dword [ebp - 0x10]
xor eax, eax
push eax
push eax
push esi
push dword [ebp - 0x1c]
push eax
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
push str.ping__URL:
lea ecx, [ebp - 0x20]
mov ebx, eax
call fcn.00402829
push ecx
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 6
push eax
lea edx, [ebp - 0x20]
call fcn.0041384b
pop ecx
pop ecx
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00402e64
test ebx, ebx
jne 0x44b4e9
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [ebp - 0x18]
cmp eax, 0xffffffff
je 0x44b4ec
mov byte [ebx], 1
jmp 0x44b4ec
mov ebx, dword [ebp - 0x18]
cmp byte [ebx], 0
mov ecx, str.Failed
mov eax, str.Success
cmove eax, ecx
lea ecx, [ebp - 0x18]
push eax
call fcn.00402829
push str.ping_result:
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 7
call fcn.00402829
push ecx
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 8
push eax
lea edx, [ebp - 0x20]
call fcn.0041384b
pop ecx
pop ecx
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00402e64
cmp byte [ebx], 0
je 0x44b550
lea ecx, [ebp - 0x10]
call fcn.00444c53
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00402e64
add esi, 0xfffffff0
lea ecx, [edi - 0x10]
call fcn.00402e64
mov ecx, esi
call fcn.00402e64
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.00402e64
call fcn.00468f71
ret
Function at 0x453350
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x4533a3
push esi
push dword [ebp + 8]
call fcn.00453544
mov edi, eax
test edi, edi
je 0x45339e
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x45339e
mov eax, dword [ebp - 8]
jmp 0x4533b5
mov eax, dword [ebp + 0x10]
jmp 0x4533b5
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc

Function at 0x4533c0
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b3eab
mov eax, dword fs:[0]
push eax
mov eax, 0x2018
call fcn.00469150
mov eax, dword [0x50f554]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ecx + 0x58], 0
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x201c], edi
mov dword [ebp - 0x2024], eax
je 0x4534f7
push 0
push edx
call fcn.00453544
mov ebx, eax
test ebx, ebx
jne 0x453428
push esi
jmp 0x45351f
call fcn.0044f181
push eax
lea ecx, [ebp - 0x2014]
call fcn.00402899
xor ecx, ecx
lea eax, [ebp - 0x2018]
push eax
push ecx
lea eax, [ebp - 0x2020]
mov dword [ebp - 4], ecx
push eax
push ecx
push dword [ebp - 0x2024]
mov dword [ebp - 0x2020], ecx
push ebx
mov dword [ebp - 0x2018], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x201c], eax
test eax, eax
jne 0x4534b6
mov eax, dword [ebp - 0x2018]
lea ecx, [ebp - 0x2014]
shr eax, 1
push eax
call fcn.00402bd2
lea ecx, [ebp - 0x2018]
push ecx
push eax
lea eax, [ebp - 0x2020]
push eax
push 0
push dword [ebp - 0x2024]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x2014]
mov dword [ebp - 0x201c], eax
call fcn.00409889
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x201c], 0
jne 0x4534e4
mov esi, dword [ebp - 0x2014]
add esi, 0xfffffff0
push esi
call fcn.00402d9f
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.00402e64
jmp 0x453526
push esi
mov ecx, edi
call fcn.00402829
mov ecx, dword [ebp - 0x2014]
lea ecx, [ecx - 0x10]
jmp 0x4534dd
test esi, esi
jne 0x453500
mov esi, 0x4cc6b4
push dword [ecx + 0x6c]
lea ecx, [ebp - 0x2010]
push 0x1000
push ecx
push esi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x2010]
push eax
mov ecx, edi
call fcn.00402829
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004689ca
leave
ret 0x10
Function at 0x454d50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x84], ebx
test ebx, 0xffff0000
jne 0x454d7b
cmp dword [edi + 0x80], 0
jne 0x454d7b
movzx eax, bx
mov dword [edi + 0x80], eax
call fcn.0045d583
push 5
push ebx
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.00454fb6
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x45860f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x45864e
call fcn.0045d583
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x45864e
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x458656
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.0044e497
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x458d73
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x458dff
cmp dword [esi + 0x20], 0
je 0x458dff
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x458dff
cmp dword [ebp + 8], 0
je 0x458dff
xor edi, edi
mov ebx, edi
call fcn.0045d583
push 0x4bc650
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x458de3
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x458dff
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.00466c8d
mov edi, eax
add esp, 0xc
test edi, edi
je 0x458dfb
mov ecx, esi
call fcn.00458b41
mov eax, edi
jmp 0x458e01
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4