joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45eaf0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffff1fc
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
lea edx, [ebp - 0x1004]
mov eax, ebx
call fcn.0040adf8
lea edx, [ebp - 0x1804]
mov eax, edi
call fcn.0040ae48
push ebx
lea ecx, [ebp - 0x404]
push ecx
call fcn.0049fdd4
add esp, 8
lea eax, [ebp - 0xc04]
mov edx, 0x400
call fcn.00466df0
lea ecx, [ebp - 0x804]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [ebp - 0xc04]
push eax
call fcn.0049fe04
pop ecx
mov ecx, eax
lea eax, [ebp - 0xc04]
mov edx, ebx
call fcn.0040fde4
test eax, eax
je 0x45ebbb
push 0x5c
lea ecx, [ebp - 0x404]
push ecx
call fcn.0049feb9
add esp, 8
mov esi, eax
test eax, eax
je 0x45ebbb
lea edx, [ebp - 0x404]
cmp esi, edx
jbe 0x45ebbb
mov al, byte [esi - 1]
xor edx, edx
mov dl, al
cmp edx, 0x3a
je 0x45ebbb
xor ecx, ecx
mov cl, al
cmp ecx, 0x5c
je 0x45ebbb
mov byte [esi], 0
lea eax, [ebp - 0x404]
push eax
call fcn.004a186c
pop ecx
push 1
mov ecx, edi
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0045e458
cmp eax, 0xffffffff
jne 0x45ebe4
push 1
lea ecx, [ebp - 0x1804]
lea edx, [ebp - 0x1004]
mov eax, dword [ebp - 4]
call fcn.0045e458
cmp eax, 1
je 0x45ec5e
cmp eax, 2
je 0x45ec4d
inc eax
jne 0x45ec0e
push ebx
mov eax, 0x1f5
call fcn.00413388
push eax
lea edx, [ebp - 0x1e04]
push edx
call fcn.004a2e18
add esp, 0xc
jmp 0x45ec2e
mov eax, 0x1fc
call fcn.00413388
push eax
push ebx
push str._s_n_s
lea edx, [ebp - 0x1e04]
push edx
call fcn.004a2e18
add esp, 0x10
push 0x10
mov eax, 0x66
call fcn.00413388
push eax
lea edx, [ebp - 0x1e04]
push edx
push dword [0x4cfe34]
call sub.USER32.DLL_MessageBoxA
lea ecx, [ebp - 0x804]
push ecx
call fcn.004a186c
pop ecx
xor eax, eax
jmp 0x45ec60
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45ec68
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffff7f4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
push 0x4b2260
push edi
call fcn.0049fd88
add esp, 8
test eax, eax
sete bl
and ebx, 1
cmp byte [esi + 0x41d], 0
je 0x45ecee
xor eax, eax
test bl, bl
mov dword [ebp - 8], eax
je 0x45ecb1
mov dword [ebp - 8], 1
push 0x4b242e
push edi
call fcn.0049fd88
add esp, 8
test eax, eax
jne 0x45eccc
mov edx, dword [esi + 0x520]
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
je 0x45ecee
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00460108
xor ecx, ecx
xor edx, edx
mov eax, esi
call fcn.0045b204
jmp 0x45eec1
mov eax, esi
call fcn.0046110c
cmp dword [0x4d27d4], 0
je 0x45ede1
mov edx, str.FlatView
mov eax, 0x4b2263
xor ecx, ecx
call fcn.00463dec
test eax, eax
je 0x45ed1f
test bl, bl
je 0x45eec1
lea edx, [ebp - 0x40c]
mov eax, 0x4d0b94
xor ecx, ecx
call fcn.00458d38
push 0x4b242e
push edi
call fcn.0049fd88
add esp, 8
test eax, eax
je 0x45ed77
mov eax, 0x4d0b94
mov ecx, dword [ebp - 4]
mov edx, edi
call fcn.00458b94
test eax, eax
je 0x45ed77
test bl, bl
je 0x45ed69
lea eax, [ebp - 0x40c]
call fcn.0040c4d0
mov edx, eax
jmp 0x45ed6b
xor edx, edx
mov eax, esi
call fcn.0045c014
jmp 0x45eec1
lea edx, [ebp - 0x80c]
mov eax, 0x4d0b94
xor ecx, ecx
call fcn.00458d64
lea eax, [ebp - 0x80c]
push eax
lea edx, [ebp - 0xc0c]
push edx
call fcn.0049fdd4
add esp, 8
lea eax, [ebp - 0xc0c]
call fcn.0040cad0
lea eax, [ebp - 0xc0c]
xor edx, edx
call fcn.00466ea8
mov eax, esi
call fcn.00460c2c
test al, al
je 0x45eec1
lea eax, [ebp - 0x80c]
call fcn.0040c4d0
mov edx, eax
xor ecx, ecx
mov eax, esi
call fcn.0045b204
jmp 0x45eec1
lea edx, [ebp - 0x100c]
push edx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test bl, bl
je 0x45ee99
lea ecx, [ebp - 0x100c]
push ecx
lea eax, [ebp - 0x140c]
push eax
call fcn.0049fdd4
add esp, 8
lea edx, [ebp - 0x180c]
lea eax, [ebp - 0x100c]
call fcn.0040d324
lea eax, [ebp - 0x140c]
call fcn.0040ca00
lea eax, [ebp - 0x180c]
call fcn.0040ca00
lea edx, [ebp - 0x180c]
lea eax, [ebp - 0x140c]
call fcn.0040fdc0
test eax, eax
jne 0x45ee99
cmp dword [esi + 0x520], 0
jle 0x45ee5e
mov byte [esi + 0x41d], 1
jmp 0x45ee8c
xor edx, edx
mov dword [ebp - 0xc], edx
lea ecx, [ebp - 0xc]
push ecx
push 0x11
push dword [esi]
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
mov eax, 0x4cfe48
mov edx, dword [ebp - 0xc]
call fcn.00461070
push dword [ebp - 0xc]
mov ecx, dword [0x4d65d8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x14]
xor ecx, ecx
xor edx, edx
mov eax, esi
call fcn.0045b204
jmp 0x45eec1
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00466ea8
test bl, bl
je 0x45eeb6
lea eax, [ebp - 0x100c]
call fcn.0040c4d0
mov edx, eax
jmp 0x45eeb8
xor edx, edx
xor ecx, ecx
mov eax, esi
call fcn.0045b204
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45f7b4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
call sub.USER32.DLL_GetCursorPos
lea edx, [ebp - 0x14]
push edx
push dword [ebx]
call sub.USER32.DLL_ScreenToClient
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0x1012
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push 0x10
call sub.USER32.DLL_GetKeyState
test ah, 0x80
setne bl
and ebx, 1
push 0x12
call sub.USER32.DLL_GetKeyState
test ah, 0x80
setne al
and eax, 1
push 0x11
mov esi, eax
call sub.USER32.DLL_GetKeyState
test ah, 0x80
setne al
and eax, 1
test byte [ebp - 0xc], 1
jne 0x45f828
test ebx, ebx
jne 0x45f828
test esi, esi
jne 0x45f828
test eax, eax
je 0x45f82c
xor edx, edx
jmp 0x45f831
mov edx, 1
mov eax, edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45f83c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa78
push ebx
push esi
mov ebx, eax
push 0
push 0
push 0x1004
push dword [ebx]
call sub.USER32.DLL_SendMessageA
mov esi, eax
lea eax, [ebp - 0x400]
mov edx, 0x400
call fcn.00466df0
push 0x4001
lea ecx, [ebp - 0x560]
push 0x160
push ecx
lea eax, [ebp - 0x400]
push 0
push eax
call sub.SHELL32.DLL_SHGetFileInfoA
push 0x28
push 0
lea edx, [ebp - 0x588]
push edx
call fcn.0049fc54
mov dword [ebp - 0x588], 3
mov ecx, dword [ebp - 0x55c]
add esp, 0xc
mov dword [ebp - 0x56c], ecx
mov dword [ebp - 0x584], esi
xor eax, eax
mov dword [ebp - 0x580], eax
mov eax, 0x3d4
call fcn.00413388
mov dword [ebp - 0x574], eax
lea edx, [ebp - 0x588]
push edx
push 0
push 0x1007
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push dword [ebx]
call sub.USER32.DLL_SetFocus
mov byte [ebx + 0x1c], 1
push 0
push esi
push 0x1017
push dword [ebx]
call sub.USER32.DLL_SendMessageA
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x460c2c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff800
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.0046110c
cmp dword [0x4d27d4], 0
je 0x460d06
lea edx, [ebp - 0x400]
push edx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [ebp - 0x400]
call fcn.0040c9dc
mov esi, eax
cmp esi, 0xffffffff
je 0x460cb0
call fcn.00466e84
mov ecx, esi
mov edx, 1
shl edx, cl
and eax, edx
jne 0x460cb0
lea edx, [ebp - 0x800]
mov eax, 0x4d0b94
xor ecx, ecx
call fcn.00458d64
lea eax, [ebp - 0x800]
call fcn.0040cad0
lea edx, [ebp - 0x800]
push edx
call fcn.004a186c
pop ecx
xor eax, eax
jmp 0x460d08
cmp dword [0x4cfe38], 0
je 0x460cc4
push dword [0x4cfe38]
call sub.USER32.DLL_DestroyWindow
mov eax, ebx
call fcn.00460b8c
xor edx, edx
mov eax, ebx
mov dword [0x4d27d4], edx
call fcn.00460584
mov eax, ebx
call fcn.00460d90
mov byte [0x4d03e4], 0
mov eax, 0x4d03b8
call fcn.00480444
mov eax, 0x4d0370
call fcn.004612b8
mov eax, 0x4d0370
call fcn.00461440
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4618f0
Capabilities:
Get disk information
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffaa0
push ebx
push esi
mov esi, eax
mov dword [esi], edx
push 0x4001
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
push 0x4b2824
call sub.SHELL32.DLL_SHGetFileInfoA
mov ebx, eax
test ebx, ebx
jne 0x461954
lea eax, [ebp - 0x560]
push eax
push 0x400
call sub.KERNEL32.DLL_GetLogicalDriveStringsA
push 0x4001
lea edx, [ebp - 0x160]
push 0x160
push edx
lea ecx, [ebp - 0x560]
push 0
push ecx
call sub.SHELL32.DLL_SHGetFileInfoA
mov ebx, eax
push ebx
push 0
push 0x1109
push dword [esi]
call sub.USER32.DLL_SendMessageA
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x462bb8
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ecx
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
push edx
call sub.SHELL32.DLL_SHGetFileInfoA
mov eax, dword [ebp - 0x15c]
mov esp, ebp
pop ebp
ret
Function at 0x4632a8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x28], eax
mov eax, 0x4b29b4
call fcn.004a0204
mov word [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
mov edx, 1
add eax, 0xf8
call fcn.004633e0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
imul edx, dword [eax + 0x104], 0x38
mov esi, dword [ecx + 0xf8]
add esi, edx
cmp word [ebx + 0x400], 0
je 0x4632ff
lea ecx, [ebx + 0x400]
jmp 0x463301
xor ecx, ecx
mov edx, ebx
mov eax, dword [ebp - 0x28]
call fcn.004107c0
mov word [ebp - 0x14], 0
jmp 0x463351
mov edx, dword [ebx + 0xc2c]
mov dword [esi + 8], edx
mov ecx, dword [ebx + 0xc00]
mov dword [esi + 0xc], ecx
mov ecx, dword [ebx + 0xc04]
mov dword [esi + 0x10], ecx
mov eax, dword [ebx + 0xc08]
mov dword [esi + 0x14], eax
mov eax, dword [ebx + 0xc0c]
mov dword [esi + 0x18], eax
mov edx, dword [ebx + 0xc10]
mov dword [esi + 0x1c], edx
mov ecx, dword [ebx + 0xc14]
mov dword [esi + 0x20], ecx
mov ecx, dword [ebx + 0xc18]
mov dword [esi + 0x24], ecx
mov eax, dword [ebx + 0xc1c]
mov dword [esi + 0x28], eax
mov edx, dword [ebx + 0xc20]
mov dword [esi + 0x2c], edx
mov ecx, dword [ebx + 0xc24]
mov dword [esi + 0x30], ecx
mov eax, dword [ebx + 0xc28]
mov dword [esi + 0x34], eax
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x104]
inc dword [edx + 0x104]
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x463638
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff664
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push edi
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x463669
xor eax, eax
jmp 0x4637b8
mov edx, esi
mov eax, 0x80000001
call fcn.004637bf
lea edx, [ebp - 0xc]
lea ecx, [ebp - 8]
push edx
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push esi
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
je 0x4636a8
mov eax, dword [ebp - 4]
call fcn.0046395d
xor eax, eax
jmp 0x4637b8
xor ebx, ebx
mov dword [ebp - 0x14], 0xc8
mov dword [ebp - 0x18], 0x3e8
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x4d4]
push eax
push edx
lea ecx, [ebp - 0x10]
lea eax, [ebp - 0x14]
push ecx
push 0
push eax
lea edx, [ebp - 0xec]
push edx
push ebx
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegEnumValueA
test eax, eax
jne 0x463702
push dword [ebp - 0x18]
lea ecx, [ebp - 0x4d4]
lea eax, [ebp - 0xec]
push ecx
push dword [ebp - 0x10]
push 0
push eax
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegSetValueExA
inc ebx
jmp 0x4636aa
xor ebx, ebx
mov dword [ebp - 0x1c], 0xc8
lea eax, [ebp - 0x24]
lea edx, [ebp - 0x1c]
push eax
push 0
push 0
push 0
push edx
lea ecx, [ebp - 0x59c]
push ecx
push ebx
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegEnumKeyExA
test eax, eax
jne 0x4637a6
lea eax, [ebp - 0x59c]
push eax
push edi
push str._s_s
lea edx, [ebp - 0x79c]
push edx
call fcn.004a2e18
add esp, 0x10
lea ecx, [ebp - 0x59c]
push ecx
push esi
push str._s_s
lea eax, [ebp - 0x99c]
push eax
call fcn.004a2e18
add esp, 0x10
lea edx, [ebp - 0xc]
lea ecx, [ebp - 8]
lea eax, [ebp - 0x99c]
push edx
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push eax
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
jne 0x4637a6
lea edx, [ebp - 0x99c]
lea eax, [ebp - 0x79c]
call fcn.00463638
inc ebx
jmp 0x463704
mov eax, dword [ebp - 4]
call fcn.0046395d
mov eax, dword [ebp - 8]
call fcn.0046395d
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4637f5
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd28
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
cmp byte [esi], 0
je 0x463894
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push esi
push edi
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x463894
xor ebx, ebx
mov dword [ebp - 8], 0xc8
lea eax, [ebp - 0x10]
lea edx, [ebp - 8]
push eax
push 0
push 0
push 0
push edx
lea ecx, [ebp - 0xd8]
push ecx
push ebx
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegEnumKeyExA
test eax, eax
jne 0x46387b
lea eax, [ebp - 0xd8]
push eax
push esi
push str._s_s
lea edx, [ebp - 0x2d8]
push edx
call fcn.004a2e18
add esp, 0x10
lea edx, [ebp - 0x2d8]
mov eax, edi
call fcn.004637f5
inc ebx
jmp 0x463826
mov eax, dword [ebp - 4]
call fcn.0046395d
push esi
push edi
call sub.ADVAPI32.DLL_RegDeleteKeyA
test eax, eax
jne 0x463894
inc dword [0x4d61d0]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x463a00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.0046389b
mov ebx, eax
test ebx, ebx
je 0x463a43
push esi
call fcn.0049fe04
pop ecx
inc eax
push eax
push esi
push 1
push 0
push dword [ebp - 8]
push ebx
call sub.ADVAPI32.DLL_RegSetValueExA
mov dword [ebp - 0xc], eax
mov eax, ebx
call fcn.0046395d
mov eax, dword [ebp - 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x463a60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff54
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 8]
call fcn.0041113c
test eax, eax
je 0x463ad1
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0046389b
mov ebx, eax
test ebx, ebx
je 0x463b0c
lea edx, [ebp - 0xac]
mov ecx, 0x1000000
mov eax, dword [ebp - 8]
call fcn.004111c4
mov eax, esi
call fcn.00411474
add eax, eax
lea edx, [ebp - 0xac]
add eax, 2
push eax
push esi
push 1
push 0
push edx
push ebx
call sub.ADVAPI32.DLL_RegSetValueExW
mov dword [ebp - 0xc], eax
mov eax, ebx
call fcn.0046395d
jmp 0x463b0c
mov eax, esi
call fcn.00411474
add eax, eax
add eax, 2
push eax
call fcn.0049e5e4
pop ecx
mov ebx, eax
mov ecx, 0x1000000
mov edx, ebx
mov eax, esi
call fcn.004111a0
push ebx
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00463a00
mov dword [ebp - 0xc], eax
push ebx
call fcn.0049e420
pop ecx
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x463b28
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 8]
call fcn.0046389b
mov ebx, eax
test ebx, ebx
je 0x463b5d
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push dword [ebp - 4]
push ebx
call sub.ADVAPI32.DLL_RegSetValueExA
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.0046395d
mov eax, dword [ebp - 8]
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x463b80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 8]
call fcn.0046389b
mov ebx, eax
test ebx, ebx
je 0x463bb5
push dword [ebp + 8]
push dword [ebp + 0xc]
push 3
push 0
push dword [ebp - 4]
push ebx
call sub.ADVAPI32.DLL_RegSetValueExA
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.0046395d
mov eax, dword [ebp - 8]
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x463c30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
call fcn.0046390c
mov ebx, eax
mov esi, 1
test ebx, ebx
je 0x463c72
lea eax, [ebp + 8]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
push 0
push dword [ebp - 8]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov esi, eax
mov eax, ebx
call fcn.0046395d
test esi, esi
jne 0x463c7c
cmp dword [ebp + 8], 0
jne 0x463c8c
push dword [ebp + 0xc]
push edi
call fcn.0049fdd4
add esp, 8
xor eax, eax
jmp 0x463c8e
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x463cb4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff54
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 0x10]
call fcn.0041113c
test eax, eax
je 0x463d32
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0046390c
mov ebx, eax
lea edx, [ebp - 0xac]
mov ecx, 0x1000000
mov eax, dword [ebp - 8]
call fcn.004111c4
mov esi, 1
test ebx, ebx
je 0x463d1d
lea eax, [ebp + 8]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
lea ecx, [ebp - 0xac]
push 0
push ecx
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExW
mov esi, eax
mov eax, ebx
call fcn.0046395d
test esi, esi
jne 0x463d27
cmp dword [ebp + 8], 0
ja 0x463d2b
xor ebx, ebx
jmp 0x463d6a
mov ebx, 1
jmp 0x463d6a
mov eax, dword [ebp + 8]
inc eax
push eax
call fcn.0049e5e4
pop ecx
mov esi, eax
push esi
push 0x4b29cc
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00463c30
mov ebx, eax
mov ecx, dword [ebp + 8]
mov edx, edi
mov eax, esi
call fcn.004111c4
push esi
call fcn.0049e420
pop ecx
test bl, bl
jne 0x463d78
mov edx, dword [ebp + 0xc]
mov eax, edi
call fcn.00411488
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x463d84
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
call fcn.0046390c
mov ebx, eax
mov esi, 1
mov dword [ebp - 0x10], 4
test ebx, ebx
je 0x463dcd
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
push 0
push dword [ebp - 8]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov esi, eax
mov eax, ebx
call fcn.0046395d
test esi, esi
jne 0x463dd7
cmp dword [ebp - 0x10], 0
jne 0x463de0
mov edx, dword [ebp + 8]
xor eax, eax
mov dword [edi], edx
jmp 0x463de2
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x463e34
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, dword [ebp + 8]
call fcn.0046390c
mov ebx, eax
mov dword [ebp - 0xc], esi
mov edi, 1
test ebx, ebx
je 0x463e75
lea eax, [ebp - 0xc]
lea edx, [ebp - 8]
push eax
push dword [ebp + 0x10]
push edx
push 0
push dword [ebp - 4]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov edi, eax
mov eax, ebx
call fcn.0046395d
test edi, edi
jne 0x463e7f
cmp dword [ebp - 0xc], 0
jne 0x463ea8
cmp dword [ebp + 0xc], 0
je 0x463e96
push esi
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.0049fbe4
add esp, 0xc
jmp 0x463ea4
push esi
push 0
push dword [ebp + 0x10]
call fcn.0049fc54
add esp, 0xc
xor eax, eax
jmp 0x463eab
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x463ec4
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
mov ebx, eax
push 0x100
lea ecx, [ebp - 0x100]
mov eax, ebx
call fcn.00463979
test al, al
je 0x463ef3
lea edx, [ebp - 0x100]
push edx
push ebx
call sub.ADVAPI32.DLL_RegDeleteKeyA
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x463f08
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
mov esi, ecx
mov ebx, eax
push 0x100
lea ecx, [ebp - 0x104]
mov eax, ebx
call fcn.00463979
test al, al
je 0x463f5a
lea edx, [ebp - 4]
lea eax, [ebp - 0x104]
push edx
push 0x20006
push 0
push eax
push ebx
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x463f5a
push esi
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegDeleteValueA
mov eax, dword [ebp - 4]
call fcn.0046395d
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x465ed0
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push 0x4b78dc
push 1
push 0
push 0x4b790c
call sub.OLE32.DLL_CoCreateInstance
test eax, eax
jl 0x465f9b
push edi
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x50]
test esi, esi
je 0x465f1c
push esi
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp dword [ebp + 0xc], 0
je 0x465f30
push 0
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x44]
cmp dword [ebp + 8], 0
je 0x465f42
push dword [ebp + 8]
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x2c]
lea eax, [ebp - 0xc]
push eax
push 0x4b793c
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx]
test eax, eax
jl 0x465f92
push 0x104
lea eax, [ebp - 0x214]
push eax
push 0xffffffffffffffff
push dword [ebp - 4]
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
push 1
lea edx, [ebp - 0x214]
push edx
mov ecx, dword [ebp - 0xc]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
test eax, eax
jl 0x465f89
mov bl, 1
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x465fa8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
lea eax, [ebp - 4]
push eax
call sub.SHELL32.DLL_SHGetMalloc
lea edx, [ebp - 8]
push edx
push 0x10
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push ebx
push dword [ebp - 8]
call sub.SHELL32.DLL_SHGetPathFromIDListA
push dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x14]
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x465fe4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
lea eax, [ebp - 4]
push eax
call sub.SHELL32.DLL_SHGetMalloc
lea edx, [ebp - 8]
push edx
push 0x19
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push ebx
push dword [ebp - 8]
call sub.SHELL32.DLL_SHGetPathFromIDListA
push dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x14]
pop ebx
pop ecx
pop ecx
pop ebp
ret