joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46f824
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x46f94c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.0046e228
xor eax, eax
push ebp
push 0x46f927
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0046e828
test al, al
je 0x46f90b
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0046f704
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00407db8
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x46f90b
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004088b0
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0046e188
test al, al
je 0x46f907
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004088b0
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.00408908
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0046f704
pop ecx
inc edi
dec ebx
jne 0x46f8af
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f92e
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.0046e228
ret
Function at 0x46f95c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x46fbaa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.0046e228
xor eax, eax
push ebp
push 0x46fb80
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0046e828
test al, al
je 0x46fb64
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00407db8
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x46fb64
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.004088b0
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0046e188
test al, al
je 0x46fb58
mov eax, dword [ebp - 4]
call fcn.004088b0
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.00408908
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0046f274
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x46fb58
xor eax, eax
push ebp
push 0x46fb51
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.0046e228
xor eax, eax
push ebp
push 0x46fb33
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004088b0
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.00408908
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0046e22c
mov eax, dword [ebp - 4]
call fcn.004088b0
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.00408908
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0046f274
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x46fb10
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.0046f824
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.0046f95c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46fb17
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x46f9e7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46fb87
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.0046e228
ret
Function at 0x46fd50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00407d14
mov eax, dword [ebp - 8]
call fcn.00407d14
xor eax, eax
push ebp
push 0x46fe63
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor ebx, ebx
mov eax, dword [0x532be4]
cmp byte [eax], 0
je 0x46fdb6
call fcn.0040bce8
cmp byte [eax + 0x19], 0
je 0x46fda3
mov ebx, pe_nt_image_headers32
jmp 0x46fdb6
call fcn.0040bce8
cmp byte [eax + 0x18], 0
je 0x46fdb6
mov ebx, 0x200
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
or ebx, 0x20006
push ebx
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004088b0
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
push ebx
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x46fe48
cmp dword [ebp - 8], 0
jne 0x46fe11
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
test ebx, ebx
sete byte [ebp - 9]
jmp 0x46fe39
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004088b0
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
test ebx, ebx
sete byte [ebp - 9]
push ebx
call sub.kernel32.dll_SetLastError
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46fe6a
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407c90
ret
Function at 0x46fe78
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00407d14
mov eax, dword [ebp - 8]
call fcn.00407d14
xor eax, eax
push ebp
push 0x46ffb8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [edi], eax
xor ebx, ebx
mov eax, dword [0x532be4]
cmp byte [eax], 0
je 0x46feee
call fcn.0040bce8
cmp byte [eax + 0x19], 0
je 0x46fedb
mov ebx, pe_nt_image_headers32
jmp 0x46feee
call fcn.0040bce8
cmp byte [eax + 0x18], 0
je 0x46feee
mov ebx, 0x200
lea eax, [ebp - 0x18]
push eax
or ebx, 0x20019
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.004088b0
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x46ff9d
cmp dword [ebp - 8], 0
jne 0x46ff1f
xor ebx, ebx
jmp 0x46ff29
mov eax, dword [ebp - 8]
call fcn.004088b0
mov ebx, eax
lea eax, [ebp - 0x20]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x46ff94
mov eax, dword [ebp - 0x20]
call fcn.004045e8
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x46ff8c
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x46ff82
mov eax, dword [ebp - 0x1c]
mov dword [esi], eax
mov eax, dword [ebp - 0x20]
mov dword [edi], eax
mov byte [ebp - 0xd], 1
jmp 0x46ff94
mov eax, dword [ebp - 0x1c]
call fcn.00404604
jmp 0x46ff94
mov eax, dword [ebp - 0x1c]
call fcn.00404604
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ffbf
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407c90
ret

Function at 0x47029c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], ecx
mov ebp, edx
mov edi, eax
xor ebx, ebx
xor esi, esi
mov eax, dword [0x532be4]
cmp byte [eax], 0
je 0x4702e0
call fcn.0040bce8
cmp byte [eax + 0x19], 0
je 0x4702cd
mov esi, pe_nt_image_headers32
jmp 0x4702e0
call fcn.0040bce8
cmp byte [eax + 0x18], 0
je 0x4702e0
mov esi, 0x200
lea eax, [esp + 4]
push eax
or esi, 0x20019
push esi
push 0
mov eax, ebp
call fcn.004088b0
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x47032b
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x10]
call fcn.004088b0
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x470334
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [edi], eax
xor esi, esi
mov eax, dword [0x532be4]
cmp byte [eax], 0
je 0x470383
call fcn.0040bce8
cmp byte [eax + 0x19], 0
je 0x470370
mov esi, pe_nt_image_headers32
jmp 0x470383
call fcn.0040bce8
cmp byte [eax + 0x18], 0
je 0x470383
mov esi, 0x200
lea eax, [ebp - 0x10]
push eax
or esi, 0x20019
push esi
push 0
mov eax, dword [ebp - 8]
call fcn.004088b0
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4703fb
cmp dword [ebp - 0xc], 0
jne 0x4703c8
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
jmp 0x4703e9
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.004088b0
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
test bl, bl
je 0x4703f2
mov eax, dword [ebp - 0x14]
mov dword [edi], eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x470478
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, ecx
mov edi, edx
mov esi, eax
mov byte [esp], 0
xor ebx, ebx
mov eax, dword [0x532be4]
cmp byte [eax], 0
je 0x4704bd
call fcn.0040bce8
cmp byte [eax + 0x19], 0
je 0x4704aa
mov ebx, pe_nt_image_headers32
jmp 0x4704bd
call fcn.0040bce8
cmp byte [eax + 0x18], 0
je 0x4704bd
mov ebx, 0x200
lea eax, [esp + 4]
push eax
or ebx, 0x20006
push ebx
push 0
mov eax, edi
call fcn.004088b0
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
mov ebx, eax
push ebx
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x470507
mov eax, ebp
call fcn.004088b0
push eax
mov eax, dword [esp + 8]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete byte [esp]
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
movzx eax, byte [esp]
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x470514
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [0x532be4]
cmp byte [eax], 0
jne 0x470546
mov eax, dword [ebp - 8]
call fcn.004088b0
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov ebx, eax
jmp 0x4705c7
xor eax, eax
push ebp
push 0x4705a9
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [0x532be4]
cmp byte [eax], 0
je 0x470588
call fcn.0040bce8
cmp byte [eax + 0x19], 0
je 0x470575
mov ebx, pe_nt_image_headers32
jmp 0x470588
call fcn.0040bce8
cmp byte [eax + 0x18], 0
je 0x470588
mov ebx, 0x200
push 0
push ebx
mov eax, dword [ebp - 8]
call fcn.004088b0
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4705c7
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4706e4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 0x11], cl
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4708d4
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 0x10]
mov eax, 0x4708f0
call fcn.00408e88
test eax, eax
je 0x4708b1
cmp byte [ebp - 0x11], 0
je 0x4708a4
xor edx, edx
push ebp
push 0x47089a
push dword fs:[edx]
mov dword fs:[edx], esp
xor esi, esi
mov eax, dword [0x532be4]
cmp byte [eax], 0
je 0x470772
call fcn.0040bce8
cmp byte [eax + 0x19], 0
je 0x47075f
mov esi, pe_nt_image_headers32
jmp 0x470772
call fcn.0040bce8
cmp byte [eax + 0x18], 0
je 0x470772
mov esi, 0x200
lea eax, [ebp - 0x18]
push eax
or esi, 0x2000f
push esi
push 0
mov eax, dword [ebp - 0x10]
call fcn.004088b0
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
xor edx, edx
push ebp
push 0x470889
push dword fs:[edx]
mov dword fs:[edx], esp
test eax, eax
jne 0x470868
xor eax, eax
mov dword [ebp - 0x20], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryInfoKeyW
test eax, eax
jne 0x470868
mov esi, dword [ebp - 0x20]
dec esi
cmp esi, 0
jl 0x470868
mov eax, dword [0x53111c]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x1c]
call fcn.00408a34
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
call fcn.004081e8
push eax
push esi
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x47085e
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x1c]
call fcn.00408a34
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x10]
call fcn.00426490
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
call fcn.00408b0c
movzx ecx, byte [ebp - 0x11]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.004706e4
test al, al
jne 0x47085e
call fcn.0040741c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4708b1
dec esi
cmp esi, 0xffffffff
jne 0x4707e2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470890
lea eax, [ebp - 4]
xor edx, edx
call fcn.00408a34
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.004705d0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4708db
lea eax, [ebp - 0x24]
call fcn.00407c30
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407c90
ret
Function at 0x4715c0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 8], 0
mov eax, dword [ebp - 4]
add eax, 0x14
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.004088b0
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], ebx
test ebx, ebx
jbe 0x47166e
xor eax, eax
push ebp
push 0x47165d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004045e8
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], esi
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, esi
xor ecx, ecx
call fcn.0040502c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.004088b0
push eax
call sub.version.dll_GetFileVersionInfoW
cmp eax, 1
sbb eax, eax
inc eax
mov edx, dword [ebp - 4]
mov byte [edx + 8], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47166e

Function at 0x471da0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x471e76
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor esi, esi
push ebp
push 0x471e49
push dword fs:[esi]
mov dword fs:[esi], esp
test dl, dl
je 0x471dfa
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.004089ac
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0041e604
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, 0xfde9
call fcn.004083c4
jmp 0x471e09
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0xfde9
call fcn.00408568
mov eax, 1
mov edx, dword [ebp - 4]
test edx, edx
je 0x471e1a
sub edx, 4
mov edx, dword [edx]
test edx, edx
jle 0x471e3c
mov ecx, 1
imul eax, eax, 0x5517e877
mov ebx, dword [ebp - 4]
movzx ebx, byte [ebx + ecx - 1]
xor eax, dword [ebx*4 + 0x5311b0]
inc ecx
dec edx
jne 0x471e23
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x471e53
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471e7d
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00407cf0
lea eax, [ebp - 4]
call fcn.00407c54
ret
Function at 0x471e88
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x471fa8
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor ecx, ecx
push ebp
push 0x471f7b
push dword fs:[ecx]
mov dword fs:[ecx], esp
test dl, dl
je 0x471ef3
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.004089ac
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0041e604
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov ecx, 0xfde9
call fcn.004083c4
jmp 0x471f02
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0xfde9
call fcn.00408568
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x471f1c
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x471f65
mov esi, 1
push 0
push 0x5517e877
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00409714
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi - 1]
mov edx, dword [eax*8 + 0x5315b4]
mov eax, dword [eax*8 + 0x5315b0]
xor eax, dword [ebp - 0x18]
xor edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
inc esi
dec ebx
jne 0x471f27
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x471f85
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471faf
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00407cf0
lea eax, [ebp - 4]
call fcn.00407c54
ret
Function at 0x475e98
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x475f60
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00407c30
xor eax, eax
push ebp
push 0x475f3a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, esi
call fcn.004088b0
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov ebx, eax
test ebx, ebx
jle 0x475f30
inc ebx
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x475e6c]
call fcn.00409cc0
add esp, 4
push ebx
mov eax, dword [ebp - 4]
push eax
mov eax, esi
call fcn.004088b0
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
test eax, eax
je 0x475f18
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00408908
push 0
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x475e6c]
call fcn.00409cc0
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x475f44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475f67
lea eax, [ebp - 4]
mov edx, dword [0x475e6c]
call fcn.00409de4
ret

Function at 0x47a320
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x47a3bc
push 0
mov eax, ebx
call fcn.004088b0
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
test ebx, ebx
jne 0x47a397
mov ebx, esi
test ebx, ebx
je 0x47a369
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.004088b0
push eax
push 1
push 0
mov eax, edi
call fcn.004088b0
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x47a3b2
mov ecx, dword [0x532d30]
mov dl, 1
mov eax, dword [0x478300]
call fcn.004250e8
call fcn.00407328
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4