joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4555f1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
in al, 0x78
dec ebx
add cl, bl
pushfd
and al, 0x90
add byte [eax], al
add byte [eax - 0x57f78bff], ch
add cl, byte [edi]
test byte [ecx + 1], cl
add byte [eax], al
cmp byte [0x4c3c1b], 0
je 0x455751
test eax, 0x400
jne 0x455751

Function at 0x455620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor bl, bl
mov byte [esp + 0x18], bl
jmp 0x455751
mov esi, dword [esp + 0xa50]
fldz
xor edi, edi
fld dword [esp + 0x90]
mov dword [esp + 0x30], edi
fcom st(1)
mov dword [esp + 0x34], edi
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x4558c3
mov al, byte [esp + 0xa54]
cmp al, 3
je 0x45578d
cmp al, 6
jbe 0x45579c
cmp al, 8
ja 0x45579c
fadd qword [0x4b7848]
fstp dword [esp + 0x90]
jmp 0x45579e
fstp st(0)
test bl, bl
je 0x4558b2
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edx, dword [esi + 0x48]
imul edx, edx, 0x94
mov edi, eax
mov eax, dword [0x4c2f44]
mov ecx, dword [edx + eax + 0x90]
push ecx
push edi
mov dword [esp + 0x38], edi
and al, 0x38
call dword [sym.imp.GDI32.dll_SelectObject]
lea edx, [esp + 0x20c]
push edx
push edi
mov dword [esp + 0x3c], eax
call dword [sym.imp.GDI32.dll_GetTextMetricsW]
fld dword [esp + 0x90]
fld st(0)
fld qword [0x4b7858]
fadd st(1), st(0)
fxch st(1)
call 0x4ead49
fild dword [esp + 0x20c]
mov ebx, eax
lea eax, [ebx - 1]
imul eax, dword [esp + 0x21c]
fmulp st(2)
mov dword [esp + 0x28], eax
fild dword [esp + 0x28]
faddp st(2)
faddp st(1)
call 0x4ead70
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x38]
add eax, 0xfffffffd
cmp eax, 0x10
ja case.0x455842.5
movzx ecx, byte [eax + 0x45773c]
jmp dword [ecx*4 + 0x457728]
add dword [esp + 0x8c], 8
test dword [esp + 0x10], 0x100000
je case.0x455842.5
push 3
call dword [sym.imp.USER32.dll_GetSystemMetrics]
add dword [esp + 0x8c], eax
jmp case.0x455842.5
mov edx, dword [esi + 0x48]
mov eax, dword [0x4c2f44]
imul edx, edx, 0x94
mov ecx, dword [edx + eax + 0x84]
mov edx, dword [esp + 0x8c]
lea eax, [edx + ecx + 2]
mov dword [esp + 0x8c], eax
jmp case.0x455842.5
mov ecx, dword [esi + 0x7c]
imul ecx, ebx
add dword [esp + 0x8c], ecx
jmp case.0x455842.5
inc ebx
imul ebx, dword [esi + 0x7c]
add dword [esp + 0x8c], ebx
jmp case.0x455842.5
test dl, dl
jne case.0x455842.5
mov dword [esp + 0x8c], 0x1e
jmp case.0x455842.5
fstp st(0)
mov eax, SysReAllocString
mov byte [esp + 0x2f], 0
cmp dword [esp + 0x8c], eax
je 0x4558e5
cmp dword [esp + 0x88], eax
jne case.0x455bac.4
mov eax, dword [esp + 0x38]
dec eax
mov dword [esp + 0x28], 0
mov ebx, 0x400
invalid
clc
Function at 0x4557ca
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor bl, bl
mov byte [esp + 0x18], bl
jmp 0x455751
mov esi, dword [esp + 0xa50]
fldz
xor edi, edi
fld dword [esp + 0x90]
mov dword [esp + 0x30], edi
fcom st(1)
mov dword [esp + 0x34], edi
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x4558c3
mov al, byte [esp + 0xa54]
cmp al, 3
je 0x45578d
cmp al, 6
jbe 0x45579c
cmp al, 8
ja 0x45579c
fadd qword [0x4b7848]
fstp dword [esp + 0x90]
jmp 0x45579e
fstp st(0)
test bl, bl
je 0x4558b2
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edx, dword [esi + 0x48]
imul edx, edx, 0x94
mov edi, eax
mov eax, dword [0x4c2f44]
mov ecx, dword [edx + eax + 0x90]
push ecx
push edi
mov dword [esp + 0x38], edi
and al, 0x38
call dword [sym.imp.GDI32.dll_SelectObject]
lea edx, [esp + 0x20c]
push edx
push edi
mov dword [esp + 0x3c], eax
call dword [sym.imp.GDI32.dll_GetTextMetricsW]
fld dword [esp + 0x90]
fld st(0)
fld qword [0x4b7858]
fadd st(1), st(0)
fxch st(1)
call 0x4ead49
fild dword [esp + 0x20c]
mov ebx, eax
lea eax, [ebx - 1]
imul eax, dword [esp + 0x21c]
fmulp st(2)
mov dword [esp + 0x28], eax
fild dword [esp + 0x28]
faddp st(2)
faddp st(1)
call 0x4ead70
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x38]
add eax, 0xfffffffd
cmp eax, 0x10
ja case.0x455842.5
movzx ecx, byte [eax + 0x45773c]
jmp dword [ecx*4 + 0x457728]
add dword [esp + 0x8c], 8
test dword [esp + 0x10], 0x100000
je case.0x455842.5
push 3
call dword [sym.imp.USER32.dll_GetSystemMetrics]
add dword [esp + 0x8c], eax
jmp case.0x455842.5
mov edx, dword [esi + 0x48]
mov eax, dword [0x4c2f44]
imul edx, edx, 0x94
mov ecx, dword [edx + eax + 0x84]
mov edx, dword [esp + 0x8c]
lea eax, [edx + ecx + 2]
mov dword [esp + 0x8c], eax
jmp case.0x455842.5
mov ecx, dword [esi + 0x7c]
imul ecx, ebx
add dword [esp + 0x8c], ecx
jmp case.0x455842.5
inc ebx
imul ebx, dword [esi + 0x7c]
add dword [esp + 0x8c], ebx
jmp case.0x455842.5
test dl, dl
jne case.0x455842.5
mov dword [esp + 0x8c], 0x1e
jmp case.0x455842.5
fstp st(0)
mov eax, SysReAllocString
mov byte [esp + 0x2f], 0
cmp dword [esp + 0x8c], eax
je 0x4558e5
cmp dword [esp + 0x88], eax
jne case.0x455bac.4
mov eax, dword [esp + 0x38]
dec eax
mov dword [esp + 0x28], 0
mov ebx, 0x400
invalid
clc
Function at 0x457f0c
Capabilities:
Hide graphical window

Disassembly:
jmp 0x457f2a
mov eax, dword [esi + 0x34]
cmp eax, edi
mov edi, dword [sym.imp.USER32.dll_SetWindowLongW]
je 0x457f3f
push eax
mov eax, dword [esi]
push 0xfffffffffffffff0
push eax
call edi
mov eax, dword [esi + 0x38]
cmp eax, dword [esp + 0x14]
je 0x457f50
mov ecx, dword [esi]
push eax
push 0xffffffffffffffec
push ecx
call edi
test bl, bl
je 0x457f7d
mov edx, dword [esi]
push 0x37
push 0
push 0
push 0
push 0
push 0
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esi]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call edi
mov ecx, dword [esi]
push 8
push ecx
call edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret 0x10
Function at 0x459244
Capabilities:
Get graphical window text
Resolve function by parsing pe exports

Disassembly:
cmp ecx, 0x300
jne case.0x4589b5.11
and eax, 0xfffffcff
mov dword [edi], eax
jmp case.0x4589b5.11

Function at 0x45ae60
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [eax]
test eax, eax
je 0x45ae6f
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
ret

Function at 0x45e730
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x10
movzx eax, byte [esi + 4]
push ebp
mov ebp, dword [esp + 0x18]
add eax, 0xfffffff7
push edi
mov dword [esp + 8], SysReAllocString
cmp eax, 8
ja case.0x45e751.12
jmp dword [eax*4 + 0x45e850]
mov eax, dword [esi]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x19f
push eax
call edi
cmp eax, 0xffffffff
je 0x45e7fe
mov edx, dword [esi]
lea ecx, [esp + 8]
push ecx
push eax
push 0x198
push edx
call edi
jmp 0x45e7fe
mov eax, dword [esi]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0xffffffffffffffff
push 0x100c
push eax
call edi
cmp eax, 0xffffffff
je 0x45e7fe
mov edx, dword [esi]
lea ecx, [esp + 8]
push ecx
push eax
push 0x100e
push edx
mov dword [esp + 0x18], 2
call edi
jmp 0x45e7fe
mov eax, dword [esi]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 9
push 0x110a
push eax
call edi
test eax, eax
je 0x45e7fe
mov edx, dword [esi]
lea ecx, [esp + 8]
push ecx
push 1
push 0x1104
push edx
mov dword [esp + 0x18], eax
call edi
jmp 0x45e7fe
mov ecx, dword [esi]
lea eax, [esp + 8]
push eax
push 0
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esp + 8], 0x80000000
jne 0x45e818
mov eax, dword [esi]
lea edx, [esp + 8]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x45e82a
mov edx, dword [esi]
push 2
lea ecx, [esp + 0xc]
push ecx
push 0
push edx
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [ebp], eax
mov eax, dword [esp + 0x14]
sub eax, ecx
cdq
sub eax, edx
sar eax, 1
lea ecx, [eax + ecx + 2]
pop edi
mov dword [ebp + 4], ecx
pop ebp
add esp, 0x10
ret 4
Function at 0x463a50
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
sub esp, 0x25c
push ebx
push esi
mov esi, eax
test esi, esi
je 0x463ac2
cmp word [esi], 0
je 0x463ac2
push 4
push 0x4a7b10
push esi
call fcn.00483863
add esp, 0xc
test eax, eax
mov eax, esi
jne 0x463a7d
lea eax, [esi + 8]
mov ebx, 0x4a54c0
call fcn.00408fc0
test eax, eax
je 0x463ab1
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x463ac2
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
pop esi
pop ebx
add esp, 0x25c
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
test al, al
jne 0x463aa3
push 0
push 0
push 1
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x463b1a
push 0
lea ecx, [esp + 0x10]
push ecx
push 2
push 0x4a79c8
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x463b13
cmp dword [esp + 0xc], 2
jne 0x463b13
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x463aa3
pop esi
pop ebx
add esp, 0x25c
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop ebx
add esp, 0x25c
ret

Function at 0x464050
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x20010
call fcn.004932a0
push esi
push edi
push 1
push 0
push 0xffffffffffffffff
mov edi, ecx
mov ecx, dword [0x4c1688]
push 0x49eb0c
mov esi, edx
call fcn.004698a0
test edi, edi
je 0x46411e
test esi, esi
je 0x46411e
cmp esi, 0xfffffffe
je 0x46411e
mov edx, dword [ebp + 8]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0
push 0x20006
push 0
push 0x4a5c64
push 0
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x46411e
lea eax, [esi - 1]
cmp eax, 6
ja case.0x4640c6.5
jmp dword [eax*4 + 0x46432c]
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4640d2
mov ecx, dword [ebp + 0xc]
sub eax, edx
mov edx, dword [esp + 8]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne case.0x4640c6.5
mov ecx, dword [0x4c1688]
push 1
push eax
push 0xffffffffffffffff
push 0x49c138
call fcn.004698a0
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x464130
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
push ebx
push 2
push 0xfffd
cmp word [ebx], 0
je 0x464234
mov esi, ebx
call fcn.00412480
mov dword [esp + 0xc], eax
jmp 0x46423c
mov dword [esp + 0xc], 0
push 4
lea edx, [esp + 0x10]
push edx
push 4
mov eax, ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x464290
sub eax, edx
sar eax, 1
mov ecx, eax
and ecx, 0x80000001
mov dword [esp + 0x10], eax
jns 0x4642b2
dec ecx
or ecx, 0xfffffffe
inc ecx
jne 0x46426f
xor edi, edi
xor esi, esi
test eax, eax
jle 0x46431d
Function at 0x46418e
Capabilities:
Set registry value

Disassembly:
mov edx, dword [ebp + 0xc]
mov eax, dword [esp + 0x14]
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x464171
mov ecx, dword [0x4c1688]
push 1
push eax
push 0xffffffffffffffff
push 0x49c138
call fcn.004698a0
lea edx, [esp + 0x1c]
push ebx
push edx
call fcn.00485434
add esp, 0xc
xor eax, eax
mov word [esp + 0x20012], ax
lea eax, [esp + 0x18]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4641b0
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [esp + eax*2 + 0x1a], cx
test eax, eax
je 0x4641da
cmp word [esp + eax*2 + 0x16], 0xa
jne 0x4641da
dec eax
xor edx, edx
mov word [esp + eax*2 + 0x18], dx
cmp word [esp + 0x18], 0
lea ecx, [esp + 0x18]
je 0x4641fa
cmp word [ecx], 0xa
jne 0x4641f1
xor edx, edx
mov word [ecx], dx
add ecx, 2
cmp word [ecx], 0
jne 0x4641e6
test eax, eax
je 0x464210
add eax, 2
add eax, eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push 7
jmp 0x464147
xor eax, eax
mov eax, eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push 7
jmp 0x464147

Function at 0x46430c
Capabilities:
Set registry value

Disassembly:
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 0x14]
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x46426f
mov ecx, dword [0x4c1688]
push 1
push eax
push 0xffffffffffffffff
push 0x49c138
call fcn.004698a0
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8
cmp edi, 0x1fffe
jae 0x46431d
xor edx, edx
lea ecx, [edx + 0x10]
lea esp, [esp]
movzx eax, word [ebx + esi*2]
cmp eax, 0x30
jb 0x4642e3
cmp eax, 0x39
ja 0x4642e3
add eax, 0xffffffd0
jmp 0x464307
cmp eax, 0x41
jb 0x4642f2
cmp eax, 0x46
ja 0x4642f2
add eax, 0xffffffc9
jmp 0x464307
cmp eax, 0x61
jb 0x464171
cmp eax, 0x66
ja 0x464171
add eax, 0xffffffa9
imul eax, ecx
add edx, eax
inc esi
sub ecx, 0xf
jns 0x4642d0
mov byte [esp + edi + 0x18], dl
inc edi
cmp esi, dword [esp + 0x10]
jl 0x4642bc
push edi
lea edx, [esp + 0x1c]
push edx
push 3
jmp 0x464245

Function at 0x464350
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x210
push ebx
push ebp
push esi
mov esi, dword [esp + 0x220]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push 0
push esi
mov dword [esp + 0x30], 0xff
call edi
cmp eax, 0x103
je 0x464402
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
Function at 0x4643eb
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x2c]
push ecx
push esi
call ebp
test eax, eax
jne 0x46440f
mov edx, dword [esp + 0x14]
push edx
call fcn.00464350
mov bl, al
mov eax, dword [esp + 0x18]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x46440f
lea ecx, [esp + 0x20]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x46440f
lea edx, [esp + 0x18]
push edx
push eax
push eax
push eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x34]
and al, 0x34
and al, 0x34
push ecx
push 0
push esi
mov dword [esp + 0x30], 0xff
call edi
cmp eax, 0x103
jne 0x464396
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x210
ret

Function at 0x464420
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push ebx
push esi
mov esi, eax
test edi, edi
je 0x464437
cmp word [edi], 0
jne 0x464441
test esi, esi
je 0x464499
pop esi
cmp word [esi], 0
je 0x464499
mov ecx, dword [ebp + 8]
lea eax, [esp + 0xc]
push eax
push 0x2001f
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp al, 0x90
dec ecx
invalid
test eax, eax
jne 0x464499
test esi, esi
je 0x4644a6
cmp word [esi], ax
je 0x4644a6
push str.ahk_default
push esi
call fcn.00481dd9
add esp, 8
test eax, eax
jne 0x46447c
mov esi, 0x4a5c64
mov edx, dword [esp + 0xc]
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4644d3
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00464350
mov edx, dword [esp + 0x10]
add esp, 4
push edx
mov bl, al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x464499
mov eax, dword [ebp + 8]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x464499
mov ecx, dword [0x4c1688]
push 1
push 0
push 0xffffffffffffffff
push 0x49c138
call fcn.004698a0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46443a
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push ebx
push esi
mov esi, eax
test edi, edi
je 0x464437
cmp word [edi], 0
jne 0x464441
test esi, esi
je 0x464499
pop esi
cmp word [esi], 0
je 0x464499
mov ecx, dword [ebp + 8]
lea eax, [esp + 0xc]
push eax
push 0x2001f
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp al, 0x90
dec ecx
invalid
test eax, eax
jne 0x464499
test esi, esi
je 0x4644a6
cmp word [esi], ax
je 0x4644a6
push str.ahk_default
push esi
call fcn.00481dd9
add esp, 8
test eax, eax
jne 0x46447c
mov esi, 0x4a5c64
mov edx, dword [esp + 0xc]
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4644d3
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00464350
mov edx, dword [esp + 0x10]
add esp, 4
push edx
mov bl, al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x464499
mov eax, dword [ebp + 8]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x464499
mov ecx, dword [0x4c1688]
push 1
push 0
push 0xffffffffffffffff
push 0x49c138
call fcn.004698a0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x464454
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push ebx
push esi
mov esi, eax
test edi, edi
je 0x464437
cmp word [edi], 0
jne 0x464441
test esi, esi
je 0x464499
pop esi
cmp word [esi], 0
je 0x464499
mov ecx, dword [ebp + 8]
lea eax, [esp + 0xc]
push eax
push 0x2001f
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp al, 0x90
dec ecx
invalid
test eax, eax
jne 0x464499
test esi, esi
je 0x4644a6
cmp word [esi], ax
je 0x4644a6
push str.ahk_default
push esi
call fcn.00481dd9
add esp, 8
test eax, eax
jne 0x46447c
mov esi, 0x4a5c64
mov edx, dword [esp + 0xc]
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4644d3
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00464350
mov edx, dword [esp + 0x10]
add esp, 4
push edx
mov bl, al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x464499
mov eax, dword [ebp + 8]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x464499
mov ecx, dword [0x4c1688]
push 1
push 0
push 0xffffffffffffffff
push 0x49c138
call fcn.004698a0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x464eb0
Capabilities:
Clear file content

Disassembly:
mov eax, dword [esi + 0x20]
push ebx
push ebp
xor ebp, ebp
push edi
cmp eax, ebp
je 0x464edf
sub eax, dword [esi + 0x24]
mov edi, dword [esi]
sub eax, dword [esi + 8]
push 1
cdq
xor ecx, ecx
push edx
mov edx, dword [edi + 0x14]
mov word [esi + 0x1a], cx
push eax
mov ecx, esi
mov dword [esi + 0x1c], ebp
call edx
mov dword [esi + 0x20], ebp
mov dword [esi + 8], ebp
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
mov ecx, esi
call edx
mov ecx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x18]
mov edi, eax
mov eax, dword [esi]
push ebp
mov ebx, edx
mov edx, dword [eax + 0x14]
push ecx
mov ecx, esi
call edx
test al, al
je 0x464f46
mov eax, dword [esi + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x464f46
cmp ebp, ebx
jg 0x464f26
jl 0x464f1e
cmp dword [esp + 0x10], edi
jae 0x464f26
mov eax, dword [esp + 0x10]
mov ecx, ebp
jmp 0x464f2a
mov eax, edi
mov ecx, ebx
mov edx, dword [esi]
push 0
push ecx
push eax
mov eax, dword [edx + 0x14]
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x1c]
mov ecx, esi
call eax
pop edi
pop ebp
pop ebx
ret 8
pop edi
or eax, 0xffffffff
pop ebp
or edx, eax
pop ebx
ret 8

Function at 0x467cc0
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x258
push ebx
test esi, esi
je 0x467d41
cmp word [esi], 0
je 0x467d41
push 4
push 0x4a7b10
push esi
call fcn.00483863
add esp, 0xc
test eax, eax
mov eax, esi
jne 0x467cea
lea eax, [esi + 8]
mov ebx, 0x4a54c0
call fcn.00408fc0
test eax, eax
je 0x467d24
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x467d41
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test edi, edi
je 0x467d1a
mov ecx, dword [esp + 8]
mov dword [edi], ecx
mov al, 1
pop ebx
add esp, 0x258
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test edi, edi
je 0x467d31
mov dword [edi], eax
xor edx, edx
cmp eax, 0xffffffff
setne al
pop ebx
add esp, 0x258
ret
xor al, al
pop ebx
add esp, 0x258
ret

Function at 0x467f90
Capabilities:
Get file size

Disassembly:
sub esp, 0xc
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp], eax
cmp eax, 0xffffffff
jne 0x467fc7
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x467fc4
or eax, 0xffffffff
or edx, 0xffffffff
add esp, 0xc
ret
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
ret
Function at 0x468b20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push ebp
push esi
push 2
push 0
push eax
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebp, dword [esp + 0x20]
mov esi, eax
test esi, esi
je 0x468c39
mov eax, ebp
test ebp, ebp
jns 0x468b54
neg eax
jmp 0x468b86
jne 0x468b5b
mov eax, 1
lea ecx, [esp + 0xc]
push ecx
push 0x468af0
push 0xe
push esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0xffffffff
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov eax, dword [esp + 0x14]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceW]
movzx edx, ax
push 0xe
push edx
push esi
call edi
test eax, eax
je 0x468c29
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
push esi
call ebx
test eax, eax
je 0x468c28
mov ebp, dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call ebp
test eax, eax
je 0x468c24
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
cmp edx, 0xffffffff
jne 0x468bc9
mov edx, ecx
cmp ecx, 0xffffffff
jne 0x468bd2
mov ecx, dword [esp + 0x30]
push 0
push edx
push ecx
push 1
push eax
call dword [sym.imp.USER32.dll_LookupIconIdFromDirectoryEx]
test eax, eax
je 0x468c24
movzx eax, ax
push 3
push eax
push esi
call edi
mov edi, eax
test edi, edi
je 0x468c24
push edi
push esi
call ebx
test eax, eax
je 0x468c24
push eax
call ebp
mov ebx, eax
test ebx, ebx
je 0x468c24
push 0
push 0
push 0
push 0x30000
push 1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebx
call dword [sym.imp.USER32.dll_CreateIconFromResourceEx]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x28]
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0xc]
pop edi
test eax, eax
jne 0x468c6d
test ebp, ebp
jle 0x468c54
mov ecx, dword [esp + 0x1c]
lea eax, [ebp - 1]
push eax
push ecx
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconW]
pop esi
pop ebp
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
xor eax, eax
cmp ebp, 0xffffffff
setge al
dec eax
and eax, ebp
push eax
push ecx
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconW]
pop esi
pop ebp
add esp, 0x10
ret