joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45eb80
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push 0
push dword [ebp + 8]
xor bl, bl
mov byte [ebp - 1], bl
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x45ecc5
call fcn.0047f350
mov ecx, eax
push esi
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ebx, eax
push ebx
push esi
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x45ecad
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0
push eax
push str.StringFileInfo040904b0OriginalFilename
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x45ecad
mov ecx, dword [ebp + 0xc]
mov edx, ecx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x45ebf5
sub edx, esi
mov esi, dword [ebp - 8]
sar edx, 1
lea eax, [edx + 1]
cmp esi, eax
jne 0x45ecad
mov edx, dword [ebp - 0xc]
add esi, esi
sub esi, 4
jb 0x45ec31
lea esp, [esp]
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x45ec36
add edx, 4
add ecx, 4
sub esi, 4
jae 0x45ec20
cmp esi, 0xfffffffc
je 0x45ec63
mov al, byte [edx]
cmp al, byte [ecx]
jne 0x45ecad
cmp esi, 0xfffffffd
je 0x45ec63
mov al, byte [edx + 1]
cmp al, byte [ecx + 1]
jne 0x45ecad
cmp esi, 0xfffffffe
je 0x45ec63
mov al, byte [edx + 2]
cmp al, byte [ecx + 2]
jne 0x45ecad
cmp esi, 0xffffffff
je 0x45ec63
mov al, byte [edx + 3]
cmp al, byte [ecx + 3]
jne 0x45ecad
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 0
push eax
lea eax, [ebp - 0x10]
push eax
push 0x5b0654
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x45ecad
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x45ecad
cmp dword [ebp - 8], 0x34
jb 0x45ecad
mov edx, dword [ebp + 0x10]
xor ecx, ecx
mov esi, dword [eax + 8]
or ecx, esi
mov byte [ebp - 1], 1
mov dword [edx], 0
mov dword [edx + 4], esi
mov eax, dword [eax + 0xc]
mov dword [edx], eax
mov dword [edx + 4], ecx
call fcn.0047f350
push 0
push ebx
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x460170
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
mov ebx, ecx
mov eax, dword [ebx + 4]
test eax, eax
jne 0x4601d9
and dword [ebp - 0x48], 0xff0fffff
push str.m_hService__NULL
mov byte [ebp - 0x45], al
and dword [ebp - 0x48], 0xfff00000
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x4c]
push eax
push 1
push 1
push 1
push 4
push 0
push 0
mov dword [ebp - 0x30], 3
call fcn.0045e350
add esp, 0x20
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
push edi
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4601f7
mov eax, dword [ebp - 0x18]
cmp eax, 2
je 0x46024f
cmp eax, 4
je 0x46024f
mov edi, dword [sym.imp.ADVAPI32.dll_StartServiceW]
xor esi, esi
push esi
push esi
push dword [ebx + 4]
call edi
test eax, eax
jne 0x460249
lea ebx, [ebx]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x460249
cmp eax, 0x41d
je 0x460249
cmp eax, 0x41f
jne 0x460296
cmp esi, 5
je 0x460296
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push dword [ebx + 4]
inc esi
call edi
test eax, eax
je 0x460210
cmp byte [ebp + 8], 0
jne 0x46025a
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x1c]
push eax
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x4602a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x4c]
mov esi, eax
call fcn.0045aa00
push esi
push str.Failed_to_query_service__GLE__u_
push eax
push 1
push 1
push 1
push 4
push 0
push 0
call fcn.0045e350
add esp, 0x24
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 8]
mov dword [ebp + 8], eax
cmp ecx, 4
je 0x460335
jmp 0x4602c0
mov eax, 0xcccccccd
mov ecx, 0x2710
mul dword [ebp - 4]
shr edx, 3
cmp edx, 0x3e8
jae 0x4602df
mov edx, 0x3e8
jmp 0x4602e8
cmp edx, 0x2710
cmova edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x1c]
push eax
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x46032f
cmp dword [ebp - 8], edi
jbe 0x46030f
call esi
mov edi, dword [ebp - 8]
mov dword [ebp + 8], eax
jmp 0x460319
call esi
sub eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
ja 0x46032f
mov ecx, dword [ebp - 0x18]
cmp ecx, 4
jne 0x4602c0
pop edi
cmp ecx, ecx
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x18]
cmp ecx, 4
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x460350
Capabilities:
Query service status
Stop service
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 4]
test eax, eax
je 0x460439
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x46037f
cmp dword [ebp - 0x18], 1
je 0x46042e
lea eax, [ebp - 0x1c]
push eax
push 1
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
setne al
cmp byte [ebp + 8], 0
je 0x46043b
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0x32
xor eax, eax
dec esi
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 0x24
lea eax, [ebp - 0x40]
push eax
push 0
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
cmp dword [ebp - 0x3c], 1
je 0x46042e
push 0x64
call edi
test esi, esi
jg 0x4603a8
cmp byte [ebp + 0xc], 0
je 0x460439
test byte [ebp - 0x20], 1
jne 0x460439
push dword [ebp - 0x24]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x460439
push 0xf00d
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
push esi
setne bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x460450
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x590085
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
mov dword [ebp - 0x10], edi
push 0xf003f
push edi
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
jne 0x4604ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
and dword [ebp - 0x50], 0xff0fffff
xor ecx, ecx
push eax
push str.Failed_to_open_service_control_manager__GLE__u_
lea eax, [ebp - 0x54]
mov byte [ebp - 0x4d], 0
and dword [ebp - 0x50], 0xfff00000
push eax
push 1
push 1
push 1
push 4
push ecx
push ecx
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], 3
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
call fcn.0045e350
add esp, 0x24
xor bl, bl
jmp 0x4605aa
lea ecx, [ebx + 4]
mov dword [ebp - 0x20], 0
test ecx, ecx
mov dword [ebp - 0x1c], 0
mov eax, 0x592544
mov dword [ebp - 0x18], 0x4000000
cmovne eax, ecx
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.00459840
push 0xf01ff
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
cmp byte [ebp - 0x18], 0
mov edi, eax
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 0
je 0x460545
push dword [ebp - 0x24]
call fcn.0056acf4
add esp, 4
cmp byte [ebp - 0x17], 0
je 0x460556
push dword [ebp - 0x20]
call fcn.0056acf4
add esp, 4
cmp byte [ebp - 0x16], 0
je 0x460567
push dword [ebp - 0x1c]
call fcn.0056acf4
add esp, 4
test edi, edi
je 0x4605a8
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x4605a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x54]
mov esi, eax
call fcn.0045aa00
push esi
push str.Failed_to_delete_service__GLE__u_
push eax
push 1
push 1
push 1
push 4
push 0
push 0
call fcn.0045e350
mov esi, dword [ebp - 0x14]
add esp, 0x24
xor bl, bl
jmp 0x4605aa
mov bl, 1
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x4605bb
push edi
call eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x4605c2
push esi
call eax
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x461750
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5901a5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push 0x5b18f8
push 1
push 0
push 0x5b18e8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4617f2
cmp dword [ebp - 0x10], 0
mov esi, dword [ebp - 0x14]
push edi
mov eax, dword [esi]
mov edi, dword [eax + 0x1c]
je 0x4617cd
push 0x5b194c
push 0xc0
push str.c:_buildslave_steam_rel_client_win32_build_srcpublic_tier1_smartptr.h
call fcn.004767e0
add esp, 0xc
test al, al
jne 0x4617cd
int3
lea eax, [ebp - 0x10]
push eax
push esi
call edi
pop edi
test eax, eax
js 0x4617f2
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
js 0x4617f2
cmp dword [esi], 0
setne bl
jmp 0x4617f4
xor bl, bl
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 4
test ecx, ecx
je 0x46180c
mov dword [ebp - 0x10], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 5
test eax, eax
je 0x461827
mov dword [ebp - 0x14], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x462020
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push ebx
push esi
push 0x103
lea eax, [ebp - 0x23b]
mov byte [ebp - 0x23c], 0
push 0
push eax
call fcn.0056c620
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 4]
add esp, 0xc
mov dword [ebp - 0x2c], 0x104
mov dword [ebp - 0xc], 0
xor bl, bl
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
mov dword [ebp - 0x20], 0
push dword [ebp + 8]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
call esi
test eax, eax
jne 0x4621ba
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x4621b1
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4621b1
push edi
xor edi, edi
test eax, eax
je 0x4621b0
mov edi, edi
lea eax, [ebp - 0x38]
mov dword [ebp - 0x30], 0xff
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x138]
push eax
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x462192
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0x20019
push 8
lea eax, [ebp - 0x138]
push eax
push dword [ebp - 4]
call esi
test eax, eax
jne 0x46217c
push eax
push eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.SymbolicLinkValue
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x462176
cmp dword [ebp - 0x10], 6
je 0x4621ae
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x138]
push eax
push dword [ebp - 4]
call fcn.00462020
add esp, 8
test al, al
jne 0x4621ae
inc edi
cmp edi, dword [ebp - 0xc]
jb 0x462100
pop edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
mov bl, 1
pop edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4627e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5902ad
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov byte [ebp - 0x20], 0
mov byte [ebp - 0x11], 0xf
push 0
push 0
push dword [ebp + 0xc]
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov esi, eax
test esi, esi
jg 0x46284b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.string_expansion_failed__1__res__d_GLE__d
push 0xe13
push str.c:_buildslave_steam_rel_client_win32_build_srccommonwindowshelper.cpp
call fcn.004767f0
add esp, 0x14
test al, al
jne 0x462940
int3
mov al, byte [ebp - 0x11]
push edi
mov edi, 0xf
test al, al
jns 0x46285d
mov ecx, dword [ebp - 0x1c]
jmp 0x462864
movzx eax, al
mov ecx, edi
sub ecx, eax
push esi
push 1
push ecx
lea ecx, [ebp - 0x20]
call fcn.00463870
mov al, byte [ebp - 0x11]
mov esi, edi
test al, al
cmovs esi, dword [ebp - 0x18]
jns 0x4628b6
test al, 0x40
je 0x4628a0
push str._m_data.HasError__
push 0x39d
push str.c:_buildslave_steam_rel_client_win32_build_srcpublic_tier1utlstring.h
call fcn.004767e0
add esp, 0xc
test al, al
jne 0x46289d
int3
mov al, byte [ebp - 0x11]
test al, al
jns 0x4628b6
test al, 0x40
jne 0x4628b2
test al, al
jns 0x4628b6
cmp dword [ebp - 0x18], 0
jne 0x4628b6
xor ecx, ecx
jmp 0x4628bf
test al, al
lea ecx, [ebp - 0x20]
cmovs ecx, dword [ebp - 0x20]
push esi
push ecx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov esi, eax
test esi, esi
jle 0x4628ea
cmp byte [ebp - 0x11], 0
cmovl edi, dword [ebp - 0x18]
cmp esi, edi
ja 0x4628ea
lea eax, [esi - 1]
push eax
lea ecx, [ebp - 0x20]
call fcn.0046ac50
jmp 0x46293f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.string_expansion_failed__2__res__d_GLE__d
push 0xe1f
push str.c:_buildslave_steam_rel_client_win32_build_srccommonwindowshelper.cpp
call fcn.004767f0
add esp, 0x14
test al, al
jne 0x46290e
int3
mov al, byte [ebp - 0x11]
test al, al
jns 0x462930
test al, 0x40
jne 0x46293f
test al, al
jns 0x462930
call fcn.0047f350
push 0
push dword [ebp - 0x20]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
mov ecx, eax
call edx
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x20], 0
mov byte [ebp - 0x11], 0xf
pop edi
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x20]
push esi
call fcn.0046a630
cmp byte [ebp - 0x11], 0
mov dword [ebp - 4], 1
jge 0x46296a
call fcn.0047f350
push 0
push dword [ebp - 0x20]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x462980
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x4629a1
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0x128]
mov dword [ebp - 0x128], 0x128
push eax
push edi
xor esi, esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4629fc
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call fcn.00578bd1
add esp, 8
test eax, eax
jne 0x4629e6
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x120]
mov dword [ecx + esi*4], eax
inc esi
lea eax, [ebp - 0x128]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4629fb
cmp esi, ebx
jl 0x4629c3
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x463820
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push 0x90
lea eax, [ebp - 0x90]
push 0
push eax
call fcn.0056c620
add esp, 0xc
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x90], 5
seta al
mov esp, ebp
pop ebp
ret

Function at 0x4638f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x404
test eax, eax
jne 0x4639d1
mov word [ebp - 0x404], ax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
lea eax, [ebp - 0x404]
mov dword [ebp + 0xc], 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x463a4d
mov eax, dword [ebp - 4]
push esi
push edi
cmp eax, 1
je 0x463952
cmp eax, 2
jne 0x463a04
mov esi, dword [ebp + 0xc]
and esi, 0xfffffffe
mov dword [ebp + 0xc], esi
cmp esi, 0xbebc200
jae 0x463a46
mov eax, esi
xor ecx, ecx
shr eax, 1
mov edx, 2
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0056aceb
add esp, 4
mov edi, eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp - 0x404]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp + 0xc]
xor edx, edx
shr ecx, 1
mov word [edi + ecx*2], dx
mov ecx, dword [ebp - 4]
cmp ecx, 1
je 0x4639b8
cmp ecx, 2
jne 0x4639fb
cmp eax, 0xea
jne 0x463a10
push edi
call fcn.0056acf4
add esp, 4
lea esi, [esi*2 + 0xfa0]
jmp 0x463958
push 0x200
lea ecx, [ebp - 0x404]
push ecx
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x46390b
mov eax, 0x57
mov esp, ebp
pop ebp
ret
push edi
call fcn.0056acf4
add esp, 4
pop edi
pop esi
mov eax, 0xd
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0x14]
push 0xa
push esi
push dword [ebp + 0x10]
push edi
call fcn.0046d250
push edi
mov ebx, eax
call fcn.0056acf4
add esp, 0x14
test ebx, ebx
jne 0x463a33
cmp word [edi], bx
jne 0x463a04
xor eax, eax
mov ecx, 0xea
cmp ebx, esi
pop edi
pop esi
cmovg eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0xe
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x463a60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x58f91d
push eax
mov eax, dword [ebp + 0xc]
mov dword fs:[0], esp
sub esp, 0x410
push ebx
push esi
push edi
test eax, eax
jne 0x463b41
mov word [ebp - 0x41c], ax
mov eax, dword [ebp + 0x10]
mov edi, 0x592544
test eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
cmovne edi, eax
mov dword [ebp - 0x10], 0x4000100
mov dword [ebp - 0x1c], edi
push 4
push 0
push 0
push edi
mov dword [ebp - 4], 0
call fcn.0046d410
xor ecx, ecx
mov esi, eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0056aceb
push 0
mov ebx, eax
push esi
push ebx
push edi
call fcn.0046d410
mov ecx, ebx
add esp, 0x24
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x463af7
sub ecx, edx
lea eax, [ebp - 0x41c]
sar ecx, 1
lea ecx, [ecx*2 + 2]
push ecx
push ebx
push 1
push 0
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebx
mov esi, eax
call fcn.0056acf4
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x200
lea ecx, [ebp - 0x41c]
push ecx
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x463a93
mov ecx, dword [ebp - 0xc]
mov eax, 0x57
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x463c10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x463c20
xor eax, eax
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
not eax
test edi, edi
je 0x463c62
lea ecx, [ecx]
mov cl, byte [esi]
lea esi, [esi + 1]
movzx edx, cl
mov ecx, edx
shr edx, 4
xor ecx, eax
shr eax, 4
and ecx, 0xf
xor eax, dword [ecx*4 + 0x5b22b0]
mov ecx, eax
shr eax, 4
and ecx, 0xf
xor edx, ecx
xor eax, dword [edx*4 + 0x5b22b0]
sub edi, 1
jne 0x463c30
pop edi
not eax
pop esi
pop ebp
ret
Function at 0x464400
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
test ecx, ecx
je 0x4644e0
mov edx, dword [ecx + 0x38]
test edx, edx
je 0x4644e0
mov ebx, dword [ebp + 0xc]
cmp ebx, dword [ecx + 0x10]
jae 0x4644e0
cmp dword [ecx + 0x14], 1
jne 0x4644e0
mov eax, dword [edx + 0x10]
mov edi, dword [eax + ebx*4]
add edi, dword [edx]
je 0x4644e0
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x4644e0
mov dword [esi], ebx
mov eax, dword [ecx + 0x38]
push 0
mov eax, dword [eax + 0x10]
mov eax, dword [eax + ebx*4]
mov dword [esi + 4], eax
movzx eax, word [edi + 4]
mov word [esi + 8], ax
movzx eax, word [edi + 6]
mov word [esi + 0xa], ax
movzx eax, word [edi + 8]
mov word [esi + 0xc], ax
movzx eax, word [edi + 0xa]
mov word [esi + 0xe], ax
movzx eax, word [edi + 0xe]
push eax
movzx eax, word [edi + 0xc]
push eax
call fcn.00463c70
mov dword [esi + 0x10], eax
add esp, 0xc
mov eax, dword [edi + 0x10]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 0
mov eax, dword [edi + 0x18]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], 0
movzx eax, word [edi + 0x24]
mov word [esi + 0x28], ax
mov eax, dword [edi + 0x26]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x2a]
pop edi
mov dword [esi + 0x30], eax
mov eax, 1
mov dword [esi + 0x34], 0
mov byte [esi + 0x3c], 0
mov byte [esi + 0x140], 0
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret