joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ef64
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x46f01c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.0046ec88
test al, al
je 0x46effe
mov ecx, dword [ebp - 0x1c]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00407db8
mov ebx, dword [ebp - 0x20]
dec ebx
test ebx, ebx
jl 0x46effe
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00408ac4
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumValueW
mov eax, dword [ebp - 4]
call fcn.00408ac4
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00408b1c
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x46efb7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f023
lea eax, [ebp - 0x2c]
call fcn.00407c30
lea eax, [ebp - 4]
call fcn.00407c30
ret

Function at 0x46f5b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.0046e400
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00408ac4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.0046e5e8
test al, al
jne 0x46f618
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x534e8c]
mov dl, 1
mov eax, dword [0x46d1d4]
call fcn.00425534
call fcn.00407328
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x46f624
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00408ac4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov edx, eax
mov eax, ebx
call fcn.0046e5e8
test al, al
jne 0x46f685
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x535190]
mov dl, 1
mov eax, dword [0x46d1d4]
call fcn.00425534
call fcn.00407328
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0046e430
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4701b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00407d14
mov eax, dword [ebp - 8]
call fcn.00407d14
xor eax, eax
push ebp
push 0x4702c3
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor ebx, ebx
mov eax, dword [0x534bcc]
cmp byte [eax], 0
je 0x470216
call fcn.0040c054
cmp byte [eax + 0x19], 0
je 0x470203
mov ebx, pe_nt_image_headers32
jmp 0x470216
call fcn.0040c054
cmp byte [eax + 0x18], 0
je 0x470216
mov ebx, 0x200
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
or ebx, 0x20006
push ebx
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00408ac4
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
push ebx
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x4702a8
cmp dword [ebp - 8], 0
jne 0x470271
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
test ebx, ebx
sete byte [ebp - 9]
jmp 0x470299
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00408ac4
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
test ebx, ebx
sete byte [ebp - 9]
push ebx
call sub.kernel32.dll_SetLastError
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4702ca
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407c90
ret
Function at 0x4702d8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00407d14
mov eax, dword [ebp - 8]
call fcn.00407d14
xor eax, eax
push ebp
push 0x470418
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [edi], eax
xor ebx, ebx
mov eax, dword [0x534bcc]
cmp byte [eax], 0
je 0x47034e
call fcn.0040c054
cmp byte [eax + 0x19], 0
je 0x47033b
mov ebx, pe_nt_image_headers32
jmp 0x47034e
call fcn.0040c054
cmp byte [eax + 0x18], 0
je 0x47034e
mov ebx, 0x200
lea eax, [ebp - 0x18]
push eax
or ebx, 0x20019
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.00408ac4
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4703fd
cmp dword [ebp - 8], 0
jne 0x47037f
xor ebx, ebx
jmp 0x470389
mov eax, dword [ebp - 8]
call fcn.00408ac4
mov ebx, eax
lea eax, [ebp - 0x20]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4703f4
mov eax, dword [ebp - 0x20]
call fcn.004045e8
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4703ec
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x4703e2
mov eax, dword [ebp - 0x1c]
mov dword [esi], eax
mov eax, dword [ebp - 0x20]
mov dword [edi], eax
mov byte [ebp - 0xd], 1
jmp 0x4703f4
mov eax, dword [ebp - 0x1c]
call fcn.00404604
jmp 0x4703f4
mov eax, dword [ebp - 0x1c]
call fcn.00404604
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47041f
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407c90
ret

Function at 0x4706fc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], ecx
mov ebp, edx
mov edi, eax
xor ebx, ebx
xor esi, esi
mov eax, dword [0x534bcc]
cmp byte [eax], 0
je 0x470740
call fcn.0040c054
cmp byte [eax + 0x19], 0
je 0x47072d
mov esi, pe_nt_image_headers32
jmp 0x470740
call fcn.0040c054
cmp byte [eax + 0x18], 0
je 0x470740
mov esi, 0x200
lea eax, [esp + 4]
push eax
or esi, 0x20019
push esi
push 0
mov eax, ebp
call fcn.00408ac4
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x47078b
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x10]
call fcn.00408ac4
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x470794
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [edi], eax
xor esi, esi
mov eax, dword [0x534bcc]
cmp byte [eax], 0
je 0x4707e3
call fcn.0040c054
cmp byte [eax + 0x19], 0
je 0x4707d0
mov esi, pe_nt_image_headers32
jmp 0x4707e3
call fcn.0040c054
cmp byte [eax + 0x18], 0
je 0x4707e3
mov esi, 0x200
lea eax, [ebp - 0x10]
push eax
or esi, 0x20019
push esi
push 0
mov eax, dword [ebp - 8]
call fcn.00408ac4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x47085b
cmp dword [ebp - 0xc], 0
jne 0x470828
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
jmp 0x470849
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.00408ac4
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
test bl, bl
je 0x470852
mov eax, dword [ebp - 0x14]
mov dword [edi], eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4708d8
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, ecx
mov edi, edx
mov esi, eax
mov byte [esp], 0
xor ebx, ebx
mov eax, dword [0x534bcc]
cmp byte [eax], 0
je 0x47091d
call fcn.0040c054
cmp byte [eax + 0x19], 0
je 0x47090a
mov ebx, pe_nt_image_headers32
jmp 0x47091d
call fcn.0040c054
cmp byte [eax + 0x18], 0
je 0x47091d
mov ebx, 0x200
lea eax, [esp + 4]
push eax
or ebx, 0x20006
push ebx
push 0
mov eax, edi
call fcn.00408ac4
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
mov ebx, eax
push ebx
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x470967
mov eax, ebp
call fcn.00408ac4
push eax
mov eax, dword [esp + 8]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete byte [esp]
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
movzx eax, byte [esp]
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x470974
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [0x534bcc]
cmp byte [eax], 0
jne 0x4709a6
mov eax, dword [ebp - 8]
call fcn.00408ac4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov ebx, eax
jmp 0x470a27
xor eax, eax
push ebp
push 0x470a09
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [0x534bcc]
cmp byte [eax], 0
je 0x4709e8
call fcn.0040c054
cmp byte [eax + 0x19], 0
je 0x4709d5
mov ebx, pe_nt_image_headers32
jmp 0x4709e8
call fcn.0040c054
cmp byte [eax + 0x18], 0
je 0x4709e8
mov ebx, 0x200
push 0
push ebx
mov eax, dword [ebp - 8]
call fcn.00408ac4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x470a27
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x470b44
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 0x11], cl
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x470d34
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 0x10]
mov eax, 0x470d50
call fcn.0040909c
test eax, eax
je 0x470d11
cmp byte [ebp - 0x11], 0
je 0x470d04
xor edx, edx
push ebp
push 0x470cfa
push dword fs:[edx]
mov dword fs:[edx], esp
xor esi, esi
mov eax, dword [0x534bcc]
cmp byte [eax], 0
je 0x470bd2
call fcn.0040c054
cmp byte [eax + 0x19], 0
je 0x470bbf
mov esi, pe_nt_image_headers32
jmp 0x470bd2
call fcn.0040c054
cmp byte [eax + 0x18], 0
je 0x470bd2
mov esi, 0x200
lea eax, [ebp - 0x18]
push eax
or esi, 0x2000f
push esi
push 0
mov eax, dword [ebp - 0x10]
call fcn.00408ac4
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
xor edx, edx
push ebp
push 0x470ce9
push dword fs:[edx]
mov dword fs:[edx], esp
test eax, eax
jne 0x470cc8
xor eax, eax
mov dword [ebp - 0x20], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryInfoKeyW
test eax, eax
jne 0x470cc8
mov esi, dword [ebp - 0x20]
dec esi
cmp esi, 0
jl 0x470cc8
mov eax, dword [0x533104]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x1c]
call fcn.00408c48
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
call fcn.004081e8
push eax
push esi
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x470cbe
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x1c]
call fcn.00408c48
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x10]
call fcn.0042680c
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
call fcn.00408d20
movzx ecx, byte [ebp - 0x11]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00470b44
test al, al
jne 0x470cbe
call fcn.0040741c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x470d11
dec esi
cmp esi, 0xffffffff
jne 0x470c42
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470cf0
lea eax, [ebp - 4]
xor edx, edx
call fcn.00408c48
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00470a30
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470d3b
lea eax, [ebp - 0x24]
call fcn.00407c30
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407c90
ret
Function at 0x471a20
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 8], 0
mov eax, dword [ebp - 4]
add eax, 0x14
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00408ac4
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], ebx
test ebx, ebx
jbe 0x471ace
xor eax, eax
push ebp
push 0x471abd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004045e8
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], esi
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, esi
xor ecx, ecx
call fcn.0040502c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00408ac4
push eax
call sub.version.dll_GetFileVersionInfoW
cmp eax, 1
sbb eax, eax
inc eax
mov edx, dword [ebp - 4]
mov byte [edx + 8], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x471ace
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x472200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4722d6
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor esi, esi
push ebp
push 0x4722a9
push dword fs:[esi]
mov dword fs:[esi], esp
test dl, dl
je 0x47225a
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00408bc0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0041e980
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, 0xfde9
call fcn.004083d4
jmp 0x472269
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0xfde9
call fcn.0040877c
mov eax, 1
mov edx, dword [ebp - 4]
test edx, edx
je 0x47227a
sub edx, 4
mov edx, dword [edx]
test edx, edx
jle 0x47229c
mov ecx, 1
imul eax, eax, 0x5517e877
mov ebx, dword [ebp - 4]
movzx ebx, byte [ebx + ecx - 1]
xor eax, dword [ebx*4 + 0x533198]
inc ecx
dec edx
jne 0x472283
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4722b3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4722dd
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00407cf0
lea eax, [ebp - 4]
call fcn.00407c54
ret
Function at 0x4722e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x472408
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor ecx, ecx
push ebp
push 0x4723db
push dword fs:[ecx]
mov dword fs:[ecx], esp
test dl, dl
je 0x472353
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.00408bc0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0041e980
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov ecx, 0xfde9
call fcn.004083d4
jmp 0x472362
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0xfde9
call fcn.0040877c
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x47237c
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x4723c5
mov esi, 1
push 0
push 0x5517e877
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00409a6c
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi - 1]
mov edx, dword [eax*8 + 0x53359c]
mov eax, dword [eax*8 + 0x533598]
xor eax, dword [ebp - 0x18]
xor edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
inc esi
dec ebx
jne 0x472387
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4723e5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47240f
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00407cf0
lea eax, [ebp - 4]
call fcn.00407c54
ret
Function at 0x476670
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x476738
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00407c30
xor eax, eax
push ebp
push 0x476712
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, esi
call fcn.00408ac4
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov ebx, eax
test ebx, ebx
jle 0x476708
inc ebx
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x476644]
call fcn.0040a018
add esp, 4
push ebx
mov eax, dword [ebp - 4]
push eax
mov eax, esi
call fcn.00408ac4
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
test eax, eax
je 0x4766f0
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00408b1c
push 0
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x476644]
call fcn.0040a018
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47671c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47673f
lea eax, [ebp - 4]
mov edx, dword [0x476644]
call fcn.0040a13c
ret

Function at 0x47aaf8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x47ab94
push 0
mov eax, ebx
call fcn.00408ac4
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
test ebx, ebx
jne 0x47ab6f
mov ebx, esi
test ebx, ebx
je 0x47ab41
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.00408ac4
push eax
push 1
push 0
mov eax, edi
call fcn.00408ac4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x47ab8a
mov ecx, dword [0x534d18]
mov dl, 1
mov eax, dword [0x478ad8]
call fcn.00425464
call fcn.00407328
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x47acdc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x40f76c]
call fcn.00409418
xor eax, eax
push ebp
push 0x47ae26
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x533ff8], 0
jne 0x47ad30
mov ecx, dword [0x534b8c]
mov dl, 1
mov eax, dword [0x41a3b0]
call fcn.00425464
call fcn.00407328
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, 0x10
call fcn.0040502c
mov eax, ebx
call fcn.00408830
mov dword [ebp - 0x20], eax
push esi
mov esi, 0x47ae34
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x34]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.0040b798
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
test eax, eax
je 0x47ad77
sub eax, 4
mov eax, dword [eax]
shr eax, 1
test eax, eax
jle 0x47adcc
mov dword [ebp - 0x14], 0x20
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x54]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x47adc5
lea eax, [ebp - 0x58]
mov edx, ebx
call fcn.00408bac
mov eax, dword [ebp - 0x58]
push eax
lea eax, [ebp - 0x5c]
lea edx, [ebp - 0x54]
mov ecx, 0x10
call fcn.00408b70
mov eax, dword [ebp - 0x5c]
pop edx
call fcn.0041e93c
test eax, eax
jne 0x47adc5
mov ebx, 0x15
jmp 0x47add1
mov ebx, 0x10
jmp 0x47add1
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x24]
push eax
push ebx
push 0
push esi
call dword [0x533ff8]
call fcn.0047aabc
mov eax, dword [ebp - 4]
call fcn.0047aabc
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.0040b7b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ae2d
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.00407c90
lea eax, [ebp - 0xc]
mov edx, dword [0x40f76c]
call fcn.004094f0
ret

Function at 0x47bcb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47bd7f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407c30
xor edx, edx
push ebp
push 0x47bd5c
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xff
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
test eax, eax
je 0x47bd52
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.00408b1c
mov eax, dword [ebx]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
test eax, eax
je 0x47bd22
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x47bd38
mov eax, ebx
mov edx, 0x47bd9c
call fcn.00408cc8
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0047bc60
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00408010
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47bd66
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47bd86
lea eax, [ebp - 0x208]
call fcn.00407c30
ret