joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45cd74
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xffffffec
mov ebx, eax
push esp
call sub.USER32.DLL_GetCursorPos
push esp
push dword [ebx]
call sub.USER32.DLL_ScreenToClient
mov eax, esp
push eax
push 0
push 0x1012
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push 0x10
call sub.USER32.DLL_GetKeyState
test ah, 0x80
setne bl
and ebx, 1
push 0x12
call sub.USER32.DLL_GetKeyState
test ah, 0x80
setne al
and eax, 1
push 0x11
mov esi, eax
call sub.USER32.DLL_GetKeyState
test ah, 0x80
setne al
and eax, 1
test byte [esp + 8], 1
jne 0x45cddf
test ebx, ebx
jne 0x45cddf
test esi, esi
jne 0x45cddf
test eax, eax
je 0x45cde3
xor edx, edx
jmp 0x45cde8
mov edx, 1
mov eax, edx
add esp, 0x14
pop esi
pop ebx
ret

Function at 0x45cdf0
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffa78
mov ebx, eax
push 0
push 0
push 0x1004
push dword [ebx]
call sub.USER32.DLL_SendMessageA
mov esi, eax
mov eax, esp
mov edx, 0x400
call fcn.00463d8c
push 0x4001
push 0x160
lea ecx, [esp + 0x408]
push ecx
push 0
lea eax, [esp + 0x10]
push eax
call sub.SHELL32.DLL_SHGetFileInfoA
push 0x28
push 0
lea edx, [esp + 0x568]
push edx
call fcn.00497ae0
add esp, 0xc
xor eax, eax
mov dword [esp + 0x560], 3
mov ecx, dword [esp + 0x404]
mov dword [esp + 0x57c], ecx
mov dword [esp + 0x564], esi
mov dword [esp + 0x568], eax
mov eax, 0x3d4
call fcn.004125b4
mov dword [esp + 0x574], eax
lea edx, [esp + 0x560]
push edx
push 0
push 0x1007
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push dword [ebx]
call sub.USER32.DLL_SetFocus
mov byte [ebx + 0x1c], 1
push 0
push esi
push 0x1017
push dword [ebx]
call sub.USER32.DLL_SendMessageA
add esp, 0x588
pop esi
pop ebx
ret
Function at 0x45d218
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff178
mov ebx, eax
cmp dword [0x4c77c4], 0
je 0x45d234
mov edx, str.ArcSort
jmp 0x45d239
mov edx, str.FileSort
mov eax, 0x4a8e03
xor ecx, ecx
call fcn.0046136c
mov edi, eax
mov eax, edi
and eax, 0x1f
cmp eax, 2
jne 0x45d378
xor esi, esi
mov dword [esp + 8], esi
xor eax, eax
mov dword [esp + 0xc], eax
lea edx, [esp + 4]
mov dword [esp + 4], 4
push edx
push 0
push 0x1005
push dword [ebx]
call sub.USER32.DLL_SendMessageA
test eax, eax
je 0x45d378
mov eax, 0x4c9804
mov edx, dword [esp + 0x24]
call fcn.00460ba0
mov ebp, esi
mov dword [eax + 8], ebp
mov eax, dword [0x4c77c4]
test eax, eax
jne 0x45d372
mov byte [esp + 0x2c], 0
add eax, 2
lea edx, [esp + 0x2c]
mov dword [esp + 0x84], eax
lea ecx, [esp + 0x7c]
mov dword [esp + 0x94], 0x50
mov dword [esp + 0x90], edx
push ecx
push ebp
push 0x102d
push dword [ebx]
call sub.USER32.DLL_SendMessageA
cmp byte [esp + 0x2c], 0
jne 0x45d372
lea ecx, [esp + 0xa4]
mov eax, 0x4c9804
mov edx, dword [esp + 0x24]
call fcn.004609e4
push 0x400
push 0x160
lea eax, [esp + 0xcdc]
push eax
push 0
lea edx, [esp + 0xb4]
push edx
call sub.SHELL32.DLL_SHGetFileInfoA
test eax, eax
je 0x45d372
cmp byte [esp + 0xde4], 0
jne 0x45d33f
lea ecx, [esp + 0xde4]
lea edx, [esp + 0xa4]
mov eax, ebx
call fcn.0045cef4
mov ecx, dword [0x4c77c4]
lea eax, [esp + 0xde4]
add ecx, 2
lea edx, [esp + 0xe34]
mov dword [esp + 0xe3c], ecx
mov dword [esp + 0xe48], eax
push edx
push ebp
push 0x102e
push dword [ebx]
call sub.USER32.DLL_SendMessageA
inc esi
jmp 0x45d257
mov edx, 0x4a901d
mov eax, 0x4a8e03
mov ecx, 1
call fcn.0046136c
test eax, eax
je 0x45d393
or edi, 0x40
mov edx, str.FlatView
mov eax, 0x4a8e03
xor ecx, ecx
call fcn.0046136c
test eax, eax
je 0x45d3ae
or edi, 0x80
push 0x45816b
push edi
push 0x1030
push dword [ebx]
call sub.USER32.DLL_SendMessageA
cmp dword [ebx + 4], 0
je 0x45d4c7
test edi, 0x20
setne al
and eax, 1
and edi, 0x1f
or ebp, 0xffffffff
mov byte [esp], al
xor eax, eax
mov edx, eax
shl edx, 3
sub edx, eax
cmp edi, dword [edx*4 + 0x4a8c90]
jne 0x45d3fa
mov ebp, dword [edx*4 + 0x4a8c8c]
jmp 0x45d400
inc eax
cmp eax, 7
jl 0x45d3e1
push 0
push ebp
push 0x108c
push dword [ebx]
call sub.USER32.DLL_SendMessageA
mov dword [esp + 0xe5c], 0x24
xor esi, esi
lea eax, [esp + 0xe5c]
push eax
mov edi, esi
push edi
push 0x1203
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
test eax, eax
je 0x45d46b
test byte [esp + 0xe71], 8
je 0x45d465
and dword [esp + 0xe70], 0xffffe7ff
lea eax, [esp + 0xe5c]
push eax
push edi
push 0x1204
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
jmp 0x45d46b
inc esi
cmp esi, 0x10
jl 0x45d41c
push dword [ebx + 0xc]
push 0
push 0x1208
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
lea edx, [esp + 0xe5c]
push edx
push ebp
push 0x1203
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
or dword [esp + 0xe70], 0x1800
mov ecx, 1
cmp byte [esp], 0
jne 0x45d4aa
dec ecx
mov dword [esp + 0xe78], ecx
lea eax, [esp + 0xe5c]
push eax
push ebp
push 0x1204
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
add esp, 0xe88
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x45e180
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffff800
mov ebx, eax
mov eax, ebx
call fcn.0045e65c
cmp dword [0x4c77c4], 0
je 0x45e24b
push esp
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov eax, esp
call fcn.0040c1ec
mov esi, eax
cmp esi, 0xffffffff
je 0x45e1fa
call fcn.00463e18
mov ecx, esi
mov edx, 1
shl edx, cl
and eax, edx
jne 0x45e1fa
lea edx, [esp + 0x400]
mov eax, 0x4c5b84
xor ecx, ecx
call fcn.00457568
lea eax, [esp + 0x400]
call fcn.0040c2e0
lea edx, [esp + 0x400]
push edx
call fcn.004995f4
pop ecx
xor eax, eax
jmp 0x45e24d
mov eax, dword [0x4c4e28]
test eax, eax
je 0x45e209
push eax
call sub.USER32.DLL_DestroyWindow
mov eax, ebx
call fcn.0045e0ec
xor edx, edx
mov eax, ebx
mov dword [0x4c77c4], edx
call fcn.0045db04
mov eax, ebx
call fcn.0045e2d8
mov byte [0x4c53d4], 0
mov eax, 0x4c53a8
call fcn.0047c8d4
mov eax, 0x4c5360
call fcn.0045e7f4
mov eax, 0x4c5360
call fcn.0045e978
mov al, 1
add esp, 0x800
pop esi
pop ebx
ret

Function at 0x45ee14
Capabilities:
Get disk information
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffaa0
mov esi, eax
mov dword [esi], edx
push 0x4001
push 0x160
lea eax, [esp + 8]
push eax
push 0
push 0x4a9320
call sub.SHELL32.DLL_SHGetFileInfoA
mov ebx, eax
test ebx, ebx
jne 0x45ee73
lea eax, [esp + 0x160]
push eax
push 0x400
call sub.KERNEL32.DLL_GetLogicalDriveStringsA
push 0x4001
push 0x160
lea edx, [esp + 8]
push edx
push 0
lea ecx, [esp + 0x170]
push ecx
call sub.SHELL32.DLL_SHGetFileInfoA
mov ebx, eax
push ebx
push 0
push 0x1109
push dword [esi]
call sub.USER32.DLL_SendMessageA
add esp, 0x560
pop esi
pop ebx
ret
Function at 0x460114
Capabilities:
Get file system object information

Disassembly:
add esp, 0xfffffea0
push ecx
push 0x160
lea eax, [esp + 8]
push eax
push 0
push edx
call sub.SHELL32.DLL_SHGetFileInfoA
mov eax, dword [esp + 4]
add esp, 0x160
ret
Function at 0x4607fc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x28], eax
mov eax, 0x4a9470
call fcn.00498090
mov word [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
mov edx, 1
add eax, 0xf8
call fcn.00460934
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
imul edx, dword [eax + 0x104], 0x38
mov esi, dword [ecx + 0xf8]
add esi, edx
cmp word [ebx + 0x400], 0
je 0x460853
lea ecx, [ebx + 0x400]
jmp 0x460855
xor ecx, ecx
mov edx, ebx
mov eax, dword [ebp - 0x28]
call fcn.0040fbe0
mov word [ebp - 0x14], 0
jmp 0x4608a5
mov edx, dword [ebx + 0xc2c]
mov dword [esi + 8], edx
mov ecx, dword [ebx + 0xc00]
mov dword [esi + 0xc], ecx
mov ecx, dword [ebx + 0xc04]
mov dword [esi + 0x10], ecx
mov eax, dword [ebx + 0xc08]
mov dword [esi + 0x14], eax
mov eax, dword [ebx + 0xc0c]
mov dword [esi + 0x18], eax
mov edx, dword [ebx + 0xc10]
mov dword [esi + 0x1c], edx
mov ecx, dword [ebx + 0xc14]
mov dword [esi + 0x20], ecx
mov ecx, dword [ebx + 0xc18]
mov dword [esi + 0x24], ecx
mov eax, dword [ebx + 0xc1c]
mov dword [esi + 0x28], eax
mov edx, dword [ebx + 0xc20]
mov dword [esi + 0x2c], edx
mov ecx, dword [ebx + 0xc24]
mov dword [esi + 0x30], ecx
mov eax, dword [ebx + 0xc28]
mov dword [esi + 0x34], eax
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x104]
inc dword [edx + 0x104]
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x460bac
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff664
mov esi, edx
mov edi, eax
mov ebp, 0x4a9488
push esp
push 0x20019
push 0
push edi
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x460bdd
xor eax, eax
jmp 0x460d46
mov edx, esi
mov eax, 0x80000001
call fcn.00460d51
lea edx, [esp + 8]
push edx
lea ecx, [esp + 8]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push esi
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
je 0x460c1e
mov eax, dword [esp]
call fcn.00460ee6
xor eax, eax
jmp 0x460d46
xor ebx, ebx
mov dword [esp + 0x10], 0xc8
mov dword [esp + 0x14], 0x3e8
lea eax, [esp + 0x14]
push eax
lea edx, [esp + 0xf0]
push edx
lea ecx, [esp + 0x14]
push ecx
push 0
lea eax, [esp + 0x20]
push eax
lea edx, [esp + 0x38]
push edx
push ebx
push dword [esp + 0x1c]
call sub.ADVAPI32.DLL_RegEnumValueA
test eax, eax
jne 0x460c7f
push dword [esp + 0x14]
lea ecx, [esp + 0xf0]
push ecx
push dword [esp + 0x14]
push 0
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x18]
call sub.ADVAPI32.DLL_RegSetValueExA
inc ebx
jmp 0x460c20
xor ebx, ebx
mov dword [esp + 0x18], 0xc8
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x4e8]
push ecx
push ebx
push dword [esp + 0x1c]
call sub.ADVAPI32.DLL_RegEnumKeyExA
test eax, eax
jne 0x460d33
lea eax, [esp + 0x4d4]
lea edx, [ebp + 0x1e]
push eax
push edi
push edx
lea ecx, [esp + 0x5a8]
push ecx
call fcn.0049abc0
add esp, 0x10
lea edx, [ebp + 0x1e]
lea eax, [esp + 0x4d4]
push eax
push esi
push edx
lea ecx, [esp + 0x7a8]
push ecx
call fcn.0049abc0
add esp, 0x10
lea eax, [esp + 8]
push eax
lea edx, [esp + 8]
push edx
push 0
push 0x20006
push 0
push 0
push 0
lea ecx, [esp + 0x7b8]
push ecx
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
jne 0x460d33
lea edx, [esp + 0x79c]
lea eax, [esp + 0x59c]
call fcn.00460bac
inc ebx
jmp 0x460c81
mov eax, dword [esp]
call fcn.00460ee6
mov eax, dword [esp + 4]
call fcn.00460ee6
mov al, 1
add esp, 0x99c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x460d87
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov esi, edx
push edi
add esp, 0xfffffd28
mov edi, eax
cmp byte [esi], 0
je 0x460e22
push esp
push 0x20019
push 0
push esi
push edi
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x460e22
xor ebx, ebx
mov dword [esp + 4], 0xc8
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x24]
push ecx
push ebx
push dword [esp + 0x1c]
call sub.ADVAPI32.DLL_RegEnumKeyExA
test eax, eax
jne 0x460e09
lea eax, [esp + 0x10]
push eax
push esi
push str._s_s
lea edx, [esp + 0xe4]
push edx
call fcn.0049abc0
add esp, 0x10
mov eax, edi
lea edx, [esp + 0xd8]
call fcn.00460d87
inc ebx
jmp 0x460db2
mov eax, dword [esp]
call fcn.00460ee6
push esi
push edi
call sub.ADVAPI32.DLL_RegDeleteKeyA
test eax, eax
jne 0x460e22
inc dword [0x4cb124]
add esp, 0x2d8
pop edi
pop esi
pop ebx
ret
Function at 0x460f88
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00460e2c
mov ebx, eax
test ebx, ebx
je 0x460fcb
push esi
call fcn.00497c90
pop ecx
inc eax
push eax
push esi
push 1
push 0
push dword [ebp - 8]
push ebx
call sub.ADVAPI32.DLL_RegSetValueExA
mov dword [ebp - 0xc], eax
mov eax, ebx
call fcn.00460ee6
mov eax, dword [ebp - 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x460fe8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff54
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 8]
call fcn.00410420
test eax, eax
je 0x461059
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00460e2c
mov ebx, eax
test ebx, ebx
je 0x461094
lea edx, [ebp - 0xac]
mov ecx, 0x1000000
mov eax, dword [ebp - 8]
call fcn.00410498
mov eax, esi
call fcn.0041074c
add eax, eax
lea edx, [ebp - 0xac]
add eax, 2
push eax
push esi
push 1
push 0
push edx
push ebx
call sub.ADVAPI32.DLL_RegSetValueExW
mov dword [ebp - 0xc], eax
mov eax, ebx
call fcn.00460ee6
jmp 0x461094
mov eax, esi
call fcn.0041074c
add eax, eax
add eax, 2
push eax
call fcn.0049643c
pop ecx
mov ebx, eax
mov ecx, 0x1000000
mov edx, ebx
mov eax, esi
call fcn.00410474
push ebx
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00460f88
mov dword [ebp - 0xc], eax
push ebx
call fcn.00496274
pop ecx
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4610b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 8]
call fcn.00460e2c
mov ebx, eax
test ebx, ebx
je 0x4610e5
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push dword [ebp - 4]
push ebx
call sub.ADVAPI32.DLL_RegSetValueExA
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00460ee6
mov eax, dword [ebp - 8]
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x461108
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 8]
call fcn.00460e2c
mov ebx, eax
test ebx, ebx
je 0x46113d
push dword [ebp + 8]
push dword [ebp + 0xc]
push 3
push 0
push dword [ebp - 4]
push ebx
call sub.ADVAPI32.DLL_RegSetValueExA
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00460ee6
mov eax, dword [ebp - 8]
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x4611b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
call fcn.00460e9c
mov ebx, eax
mov esi, 1
test ebx, ebx
je 0x4611f2
lea eax, [ebp + 8]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
push 0
push dword [ebp - 8]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov esi, eax
mov eax, ebx
call fcn.00460ee6
test esi, esi
jne 0x4611fc
cmp dword [ebp + 8], 0
jne 0x46120c
push dword [ebp + 0xc]
push edi
call fcn.00497c60
add esp, 8
xor eax, eax
jmp 0x46120e
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x461234
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff54
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 0x10]
call fcn.00410420
test eax, eax
je 0x4612b2
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00460e9c
mov ebx, eax
lea edx, [ebp - 0xac]
mov ecx, 0x1000000
mov eax, dword [ebp - 8]
call fcn.00410498
mov esi, 1
test ebx, ebx
je 0x46129d
lea eax, [ebp + 8]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
lea ecx, [ebp - 0xac]
push 0
push ecx
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExW
mov esi, eax
mov eax, ebx
call fcn.00460ee6
test esi, esi
jne 0x4612a7
cmp dword [ebp + 8], 0
ja 0x4612ab
xor ebx, ebx
jmp 0x4612ea
mov ebx, 1
jmp 0x4612ea
mov eax, dword [ebp + 8]
inc eax
push eax
call fcn.0049643c
pop ecx
mov esi, eax
push esi
push 0x4a9488
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004611b0
mov ebx, eax
mov ecx, dword [ebp + 8]
mov edx, edi
mov eax, esi
call fcn.00410498
push esi
call fcn.00496274
pop ecx
test bl, bl
jne 0x4612f8
mov edx, dword [ebp + 0xc]
mov eax, edi
call fcn.00410760
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x461304
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
call fcn.00460e9c
mov ebx, eax
mov esi, 1
mov dword [ebp - 0x10], 4
test ebx, ebx
je 0x46134d
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
push 0
push dword [ebp - 8]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov esi, eax
mov eax, ebx
call fcn.00460ee6
test esi, esi
jne 0x461357
cmp dword [ebp - 0x10], 0
jne 0x461360
mov edx, dword [ebp + 8]
xor eax, eax
mov dword [edi], edx
jmp 0x461362
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4613b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, dword [ebp + 8]
call fcn.00460e9c
mov ebx, eax
mov dword [ebp - 0xc], esi
mov edi, 1
test ebx, ebx
je 0x4613f5
lea eax, [ebp - 0xc]
lea edx, [ebp - 8]
push eax
push dword [ebp + 0x10]
push edx
push 0
push dword [ebp - 4]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov edi, eax
mov eax, ebx
call fcn.00460ee6
test edi, edi
jne 0x4613ff
cmp dword [ebp - 0xc], 0
jne 0x461428
cmp dword [ebp + 0xc], 0
je 0x461416
push esi
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.00497a70
add esp, 0xc
jmp 0x461424
push esi
push 0
push dword [ebp + 0x10]
call fcn.00497ae0
add esp, 0xc
xor eax, eax
jmp 0x46142b
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x461444
Capabilities:
Delete registry key

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, eax
mov eax, ebx
push 0x100
lea ecx, [esp + 4]
call fcn.00460f02
test al, al
je 0x461468
push esp
push ebx
call sub.ADVAPI32.DLL_RegDeleteKeyA
add esp, 0x100
pop ebx
ret

Function at 0x461480
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, ecx
mov ebx, eax
mov eax, ebx
push 0x100
lea ecx, [esp + 8]
call fcn.00460f02
test al, al
je 0x4614c9
push esp
push 0x20006
push 0
lea edx, [esp + 0x10]
push edx
push ebx
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4614c9
push esi
push dword [esp + 4]
call sub.ADVAPI32.DLL_RegDeleteValueA
mov eax, dword [esp]
call fcn.00460ee6
add esp, 0x104
pop esi
pop ebx
ret
Function at 0x463228
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push 0x4ae090
push 1
push 0
push 0x4ae0c0
call sub.OLE32.DLL_CoCreateInstance
test eax, eax
jl 0x4632f3
push edi
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x50]
test esi, esi
je 0x463274
push esi
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp dword [ebp + 0xc], 0
je 0x463288
push 0
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x44]
cmp dword [ebp + 8], 0
je 0x46329a
push dword [ebp + 8]
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x2c]
lea eax, [ebp - 0xc]
push eax
push 0x4ae0f0
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx]
test eax, eax
jl 0x4632ea
push 0x104
lea eax, [ebp - 0x214]
push eax
push 0xffffffffffffffff
push dword [ebp - 4]
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
push 1
lea edx, [ebp - 0x214]
push edx
mov ecx, dword [ebp - 0xc]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
test eax, eax
jl 0x4632e1
mov bl, 1
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x463300
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
push esp
call sub.SHELL32.DLL_SHGetMalloc
lea eax, [esp + 4]
push eax
push 0x10
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push ebx
push dword [esp + 8]
call sub.SHELL32.DLL_SHGetPathFromIDListA
push dword [esp + 4]
mov edx, dword [esp + 4]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
pop ecx
pop edx
pop ebx
ret

Function at 0x463338
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
push esp
call sub.SHELL32.DLL_SHGetMalloc
lea eax, [esp + 4]
push eax
push 0x19
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push ebx
push dword [esp + 8]
call sub.SHELL32.DLL_SHGetPathFromIDListA
push dword [esp + 4]
mov edx, dword [esp + 4]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
pop ecx
pop edx
pop ebx
ret

Function at 0x463370
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push ebx
add esp, 0xffffffe0
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x463385
xor eax, eax
jmp 0x4633c3
push ebx
call fcn.00497c90
pop ecx
mov byte [ebx + eax + 1], 0
push 0x1e
push 0
lea edx, [esp + 8]
push edx
call fcn.00497ae0
add esp, 0xc
mov dword [esp + 4], 3
mov word [esp + 0x10], 0x14
mov dword [esp + 8], ebx
push esp
call sub.SHELL32.DLL_SHFileOperationA
test eax, eax
sete al
and eax, 1
add esp, 0x20
pop ebx
ret
Function at 0x4639d4
Capabilities:
Create directory

Disassembly:
push ebx
push esi
add esp, 0xfffffc00
mov esi, edx
mov ebx, eax
mov eax, esp
mov edx, 0x400
call fcn.00463d8c
mov eax, esp
call fcn.0040c210
push ebx
lea edx, [esp + 4]
push edx
call fcn.00497b84
add esp, 8
mov eax, esp
call fcn.0040ac94
test eax, eax
je 0x463a1c
push 0
lea edx, [esp + 4]
push edx
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
jne 0x463a3e
push esp
mov eax, 0x1f7
call fcn.004125b4
push eax
call fcn.00486908
add esp, 8
mov eax, 0x4b1ad4
call fcn.0042d778
xor eax, eax
jmp 0x463a4a
push esp
push esi
call fcn.00497c60
add esp, 8
mov al, 1
add esp, 0x400
pop esi
pop ebx
ret

Function at 0x463bc0
Capabilities:
Capture screenshot

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd8
mov dword [esp], eax
call sub.USER32.DLL_GetDesktopWindow
mov ebp, eax
push ebp
call sub.USER32.DLL_GetDC
mov edi, eax
push edi
call sub.GDI32.DLL_CreateCompatibleDC
mov ebx, eax
push edi
call sub.GDI32.DLL_CreateCompatibleDC
mov esi, eax
lea eax, [esp + 0x10]
push eax
push 0x18
push dword [esp + 8]
call sub.GDI32.DLL_GetObjectA
push dword [esp + 0x18]
push dword [esp + 0x18]
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [esp + 4], eax
push dword [esp]
push ebx
call sub.GDI32.DLL_SelectObject
mov dword [esp + 8], eax
push dword [esp + 4]
push esi
call sub.GDI32.DLL_SelectObject
mov dword [esp + 0xc], eax
push 0xcc0020
mov edx, dword [esp + 0x1c]
push edx
mov eax, dword [esp + 0x1c]
mov ecx, eax
neg ecx
push ecx
mov ecx, eax
dec ecx
push 0
push ecx
push ebx
push edx
push eax
push 0
push 0
push esi
call sub.GDI32.DLL_StretchBlt
push 0xcc0020
push 0
push 0
push esi
push dword [esp + 0x28]
push dword [esp + 0x28]
push 0
push 0
push ebx
call sub.GDI32.DLL_BitBlt
push dword [esp + 8]
push ebx
call sub.GDI32.DLL_SelectObject
push dword [esp + 0xc]
push esi
call sub.GDI32.DLL_SelectObject
push dword [esp + 4]
call sub.GDI32.DLL_DeleteObject
push ebx
call sub.GDI32.DLL_DeleteDC
push esi
call sub.GDI32.DLL_DeleteDC
push edi
push ebp
call sub.USER32.DLL_ReleaseDC
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x463d8c
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable

Disassembly:
push ebx
push esi
add esp, 0xfffffc00
mov esi, edx
mov ebx, eax
mov eax, 0x4a9e09
push 0x4a9df7
push esi
mov ecx, ebx
mov edx, 0x4a9e0f
call fcn.00461194
mov byte [esp], 0
cmp byte [ebx], 0
je 0x463dd7
push 0x400
lea eax, [esp + 4]
push eax
push ebx
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
test eax, eax
je 0x463dd7
mov edx, esp
mov ecx, esi
mov eax, ebx
call fcn.0040f420
cmp byte [ebx], 0
je 0x463de7
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x463e05
push ebx
push esi
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
je 0x463df7
cmp byte [ebx], 0
jne 0x463e05
push str._rartemp
push ebx
call fcn.00497c60
add esp, 8
mov eax, ebx
call fcn.0040c210
add esp, 0x400
pop esi
pop ebx
ret