joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454f02
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x476cd8], 0
jne 0x455051
push ebx
push esi
lea eax, [ebp - 0x208]
mov dword [0x476cd8], 2
push eax
push 0x20019
xor ebx, ebx
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push ebx
push 0x40e67c
push esi
mov dword [ebp - 0x208], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45504f
push edi
push 0x1fe
mov word [ebp - 0x204], ax
lea eax, [ebp - 0x202]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x214], SysReAllocString
mov dword [ebp - 0x210], esi
mov edi, ebx
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x20c], ebx
push eax
push 0x20019
push ebx
push 0x40e67c
push dword [ebp + edi*4 - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x454ffa
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0x200
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x20c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x454ffa
xor eax, eax
cmp ax, word [ebp - 0x204]
jne 0x455002
inc edi
cmp edi, 2
jb 0x454f8d
jmp 0x455042
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], ebx
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x455042
push dword [ebp - 0x210]
mov dword [0x476cd8], 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [0x476cd8], 1
sete al
xor ecx, ebp
call fcn.00468ba0
mov esp, ebp
pop ebp
ret

Function at 0x456934
Capabilities:
Encrypt data using dpapi
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 0x10]
push esi
xor esi, esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x45694e
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
push 1
push esi
push esi
push esi
push 0x40800c
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
jne 0x456989
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 8]
mov eax, dword [ebp + 8]
push dword [ebp - 4]
push 3
push esi
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x4569b3
jg 0x4569aa
mov esi, eax
jmp 0x4569b3
movzx esi, ax
or esi, 0x80070000
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x456c49
Capabilities:
Set registry value

Disassembly:
push 0x234
mov eax, 0x46e62d
call fcn.00468e30
mov edi, ecx
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x124]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x240], eax
call fcn.00445f20
and dword [ebp - 4], 0
test ebx, ebx
je 0x456d97
test esi, esi
je 0x456d97
cmp dword [ebp - 0x240], 0
je 0x456d97
push 2
mov ecx, edi
call fcn.004567d5
mov esi, eax
test esi, esi
js 0x456d9c
push ecx
push ebx
add edi, 0x18
push 0x40e770
mov ecx, edi
call fcn.004571fb
mov ebx, 0x80070000
test eax, eax
je 0x456cd3
jg 0x456cce
mov esi, eax
jmp 0x456cd3
movzx esi, ax
or esi, ebx
test esi, esi
js 0x456d9c
push dword [ebp - 0x23c]
lea ecx, [ebp - 0x238]
call fcn.00445b1b
lea edx, [ebp - 0x124]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x238]
call fcn.00454d28
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0
mov esi, eax
call fcn.00445f00
test esi, esi
js 0x456d9c
push ecx
push dword [ebp - 0x20]
mov ecx, edi
push 0x40e780
call fcn.004571fb
test eax, eax
je 0x456d39
jg 0x456d34
mov esi, eax
jmp 0x456d39
movzx esi, ax
or esi, ebx
test esi, esi
js 0x456d9c
push ecx
push dword [ebp - 0x240]
mov ecx, edi
push 0x40e790
call fcn.004571fb
test eax, eax
je 0x456d5f
jg 0x456d5a
mov esi, eax
jmp 0x456d5f
movzx esi, ax
or esi, ebx
test esi, esi
js 0x456d9c
mov eax, dword [ebp + 0x14]
push 4
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x23c]
push eax
push 4
push 0
push 0x40e7a4
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x456d9c
jg 0x456d90
mov esi, eax
jmp 0x456d9c
movzx esi, ax
or esi, ebx
jmp 0x456d9c
mov esi, 0x80070057
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x124]
call fcn.00445f00
mov eax, esi
call fcn.00468dd0
ret 0x10

Function at 0x456f3d
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push esi
push edi
mov edi, ecx
je 0x456ffd
cmp dword [ebp + 0xc], 0
je 0x456ffd
push 2
call fcn.004567d5
mov esi, eax
test esi, esi
js 0x457002
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push 4
push eax
push 4
push 0
add edi, 0x18
mov dword [ebp - 4], ecx
push 0x40e7b0
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x456f9f
jg 0x456f96
mov esi, eax
jmp 0x456f9f
movzx esi, ax
or esi, 0x80070000
test esi, esi
js 0x457002
mov eax, dword [ebp + 0x14]
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0x40e7cc
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x456fd3
jg 0x456fca
mov esi, eax
jmp 0x456fd3
movzx esi, ax
or esi, 0x80070000
test esi, esi
js 0x457002
push dword [ebp + 8]
push 0x40e7e0
push edi
call fcn.00456934
mov esi, eax
test esi, esi
js 0x457002
push dword [ebp + 0xc]
push 0x40e7f4
push edi
call fcn.00456934
mov esi, eax
jmp 0x457002
mov esi, 0x80070057
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x457180
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], ebx
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4571ed
cmp dword [ebp - 4], 1
je 0x4571c5
cmp dword [ebp - 4], 2
je 0x4571c5
push 0xd
pop eax
jmp 0x4571ed
mov ecx, dword [ebp - 8]
test esi, esi
je 0x4571e7
test ecx, ecx
je 0x4571e2
test cl, 1
jne 0x4571c0
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], bx
je 0x4571e7
jmp 0x4571c0
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4571fb
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
push edi
test edx, edx
je 0x457240
mov ecx, edx
xor ebx, ebx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x457213
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push ebx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
call fcn.0045641c
int3

Function at 0x457ca8
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push edi
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 4], edx
mov edi, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x457ccc
push 0x19
pop ecx
int 0x29
test byte [ebp - 0xc], 0x44
je 0x457d16
push ebx
push esi
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [ebp - 0x40]
xor edx, edx
lea ecx, [ebx - 1]
mov eax, ecx
lea esi, [ebx - 1]
and ecx, dword [ebp - 4]
and eax, edi
add eax, ebx
dec ecx
add eax, ecx
not esi
div ebx
xor edx, edx
and esi, edi
mov ecx, eax
mov eax, dword [ebp - 4]
div ebx
add ecx, eax
je 0x457d14
xor eax, eax
lock or dword [esi], eax
add esi, ebx
sub ecx, 1
jne 0x457d08
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4598e2
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
mov eax, dword [0x475014]
mov esi, 0x100
cmp eax, 0x475014
je 0x45992b
test dword [eax + 0x1c], esi
je 0x45992b
cmp byte [eax + 0x19], 5
jb 0x45992b
push dword [eax + 0x14]
mov edx, 0x40eec0
push dword [eax + 0x10]
push 0xa
pop ecx
call fcn.00414ca8
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x22e]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x234], 0x10
xor eax, eax
lea edi, [ebp - 0x22]
mov word [ebp - 0x24], ax
push 7
pop ecx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebx]
mov eax, dword [eax + 4]
test eax, eax
jne 0x459980
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x24]
push eax
push 0x40ee38
push 0x4094f4
lea eax, [ebp - 0x230]
push 0x104
push eax
call fcn.00416647
add esp, 0x14
test eax, eax
jns 0x4599e4
mov ecx, dword [0x475014]
cmp ecx, 0x475014
je 0x459a89
test dword [ecx + 0x1c], esi
je 0x459a89
cmp byte [ecx + 0x19], 2
jb 0x459a89
movzx eax, ax
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0xb
mov edx, 0x40eec0
pop ecx
call fcn.00414ccb
jmp 0x459a89
push 0x20019
xor edi, edi
lea edx, [ebp - 0x230]
push edi
mov ecx, SysReAllocString
call fcn.0041be9e
mov esi, eax
test esi, esi
jne 0x459a30
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x475014]
cmp ecx, 0x475014
je 0x459a89
test dword [ecx + 0x1c], 0x100
je 0x459a89
cmp byte [ecx + 0x19], 2
jb 0x459a89
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0xc
jmp 0x4599d4
push ecx
push edi
xor edx, edx
mov ecx, esi
push 0x40ee80
inc edx
call fcn.0041bf3f
mov ecx, dword [ebx]
mov dword [ecx], eax
mov eax, dword [ebx]
cmp dword [eax], edi
jne 0x459a82
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x475014]
cmp ecx, 0x475014
je 0x459a82
test dword [ecx + 0x1c], 0x100
je 0x459a82
cmp byte [ecx + 0x19], 2
jb 0x459a82
push eax
push dword [ecx + 0x14]
mov edx, 0x40eec0
push dword [ecx + 0x10]
push 0xd
pop ecx
call fcn.00414ccb
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00468ba0
mov esp, ebp
pop ebp
ret
Function at 0x459aa1
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x28], ecx
xor eax, eax
mov dword [ebp - 0x2c], 0x10
push 7
mov word [ebp - 0x24], ax
lea edi, [ebp - 0x22]
pop ecx
rep stosd dword es:[edi], eax
mov ebx, esi
stosw word es:[edi], ax
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x459b02
test dword [eax + 0x1c], 0x100
je 0x459b02
cmp byte [eax + 0x19], 5
jb 0x459b02
push dword [eax + 0x14]
mov edx, 0x40eec0
push dword [eax + 0x10]
push 0xe
pop ecx
call fcn.00414ca8
push 0x20006
push 1
mov edx, 0x40ee38
mov ecx, SysReAllocString
call fcn.0041be9e
mov edi, eax
test edi, edi
jne 0x459b68
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, dword [0x475014]
cmp ecx, 0x475014
je 0x459c74
test dword [ecx + 0x1c], 0x100
je 0x459c74
cmp byte [ecx + 0x19], 2
jb 0x459c74
push esi
push dword [ecx + 0x14]
mov edx, 0x40eec0
push dword [ecx + 0x10]
push 0xf
pop ecx
call fcn.00414ccb
jmp 0x459c74
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx + 4]
call fcn.0041e207
test eax, eax
je 0x459bcb
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x459bc6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x459c62
test dword [eax + 0x1c], 0x100
je 0x459c62
cmp byte [eax + 0x19], 2
jb 0x459c62
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x10
jmp 0x459c57
lea edx, [ebp - 0x24]
jmp 0x459bd1
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 4]
push 0x20006
push 1
mov ecx, edi
call fcn.0041be9e
mov ebx, eax
test ebx, ebx
jne 0x459c15
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, dword [0x475014]
cmp ecx, 0x475014
je 0x459c62
test dword [ecx + 0x1c], 0x100
je 0x459c62
cmp byte [ecx + 0x19], 2
jb 0x459c62
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x11
jmp 0x459c57
mov eax, dword [ebp - 0x28]
push ecx
mov ecx, ebx
push dword [eax]
push 0x40ee80
call fcn.0041c22f
test eax, eax
jne 0x459c62
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x459c62
test dword [eax + 0x1c], 0x100
je 0x459c62
cmp byte [eax + 0x19], 2
jb 0x459c62
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x12
mov edx, 0x40eec0
pop ecx
call fcn.00414ccb
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x459c74
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00468ba0
mov esp, ebp
pop ebp
ret
Function at 0x459c8c
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x2c], 0x10
mov esi, ecx
mov word [ebp - 0x24], ax
push 7
pop ecx
lea edi, [ebp - 0x22]
xor ebx, ebx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x28], ebx
stosw word es:[edi], ax
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x459ced
test dword [eax + 0x1c], 0x100
je 0x459ced
cmp byte [eax + 0x19], 5
jb 0x459ced
push dword [eax + 0x14]
mov edx, 0x40eec0
push dword [eax + 0x10]
push 0x14
pop ecx
call fcn.00414ca8
push 0x2001f
push 1
mov edx, 0x40ee38
mov ecx, SysReAllocString
call fcn.0041be9e
mov edi, eax
test edi, edi
jne 0x459d51
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x459e92
test dword [eax + 0x1c], 0x100
je 0x459e92
cmp byte [eax + 0x19], 2
jb 0x459e92
push esi
push dword [eax + 0x14]
mov edx, 0x40eec0
push dword [eax + 0x10]
push 0x15
pop ecx
call fcn.00414ccb
jmp 0x459e92
mov ecx, esi
call fcn.0041e207
test eax, eax
je 0x459dae
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x459dab
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x459e8b
test dword [eax + 0x1c], 0x100
je 0x459e8b
cmp byte [eax + 0x19], 2
jb 0x459e8b
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x16
jmp 0x459e80
lea esi, [ebp - 0x24]
mov edx, esi
mov ecx, edi
call fcn.0041c3ab
test eax, eax
jne 0x459df8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x459e8b
test dword [eax + 0x1c], 0x100
je 0x459e8b
cmp byte [eax + 0x19], 2
jb 0x459e8b
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x17
jmp 0x459e80
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x28]
push eax
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov esi, eax
test esi, esi
je 0x459e39
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x459e8b
test dword [eax + 0x1c], 0x100
je 0x459e8b
cmp byte [eax + 0x19], 2
jb 0x459e8b
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x18
jmp 0x459e80
cmp dword [ebp - 0x28], ebx
jne 0x459e8b
push ecx
push 0x40800c
push 0x40eea0
mov ecx, edi
call fcn.0041c22f
test eax, eax
jne 0x459e8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x459e8b
test dword [eax + 0x1c], 0x100
je 0x459e8b
cmp byte [eax + 0x19], 2
jb 0x459e8b
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x19
mov edx, 0x40eec0
pop ecx
call fcn.00414ccb
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00468ba0
mov esp, ebp
pop ebp
ret
Function at 0x459eaa
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x28], 0x10
xor esi, esi
lea edi, [ebp - 0x22]
xor eax, eax
push 7
mov word [ebp - 0x24], ax
pop ecx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x459f08
test dword [eax + 0x1c], 0x100
je 0x459f08
cmp byte [eax + 0x19], 5
jb 0x459f08
push dword [eax + 0x14]
mov edx, 0x40eec0
push dword [eax + 0x10]
push 0x1a
pop ecx
call fcn.00414ca8
push 0x20006
push 1
mov edx, 0x40ee38
mov ecx, SysReAllocString
call fcn.0041be9e
mov edi, eax
test edi, edi
jne 0x459f6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, dword [0x475014]
cmp ecx, 0x475014
je 0x45a00c
test dword [ecx + 0x1c], 0x100
je 0x45a00c
cmp byte [ecx + 0x19], 2
jb 0x45a00c
push esi
push dword [ecx + 0x14]
mov edx, 0x40eec0
push dword [ecx + 0x10]
push 0x1b
pop ecx
call fcn.00414ccb
jmp 0x45a00c
mov ecx, ebx
call fcn.0041e207
test eax, eax
je 0x459fbc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x459fb9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x45a005
test dword [eax + 0x1c], 0x100
je 0x45a005
cmp byte [eax + 0x19], 2
jb 0x45a005
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x1c
jmp 0x459ffa
lea ebx, [ebp - 0x24]
push ecx
push ebx
push 0x40eea0
mov ecx, edi
call fcn.0041c22f
test eax, eax
jne 0x45a005
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x45a005
test dword [eax + 0x1c], 0x100
je 0x45a005
cmp byte [eax + 0x19], 2
jb 0x45a005
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x1d
mov edx, 0x40eec0
pop ecx
call fcn.00414ccb
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00468ba0
mov esp, ebp
pop ebp
ret
Function at 0x461412
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x34], 0x10
push 7
mov esi, ecx
mov word [ebp - 0x28], ax
pop ecx
lea edi, [ebp - 0x26]
xor ebx, ebx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
stosw word es:[edi], ax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x46148c
call dword [sym.imp.KERNEL32.dll_GetLastError]
and eax, 0x1fff0000
cmp eax, 0x70000
jne 0x46147f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
and edi, 0xffff
jmp 0x4615b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x4615b3
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov edi, eax
test edi, edi
js 0x461564
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x30], 1
push eax
push ecx
xor edx, edx
call fcn.0041d970
mov edi, eax
test edi, edi
jns 0x46150c
and eax, 0x1fff0000
cmp eax, 0x70000
movzx eax, di
je 0x4614c7
mov eax, edi
cmp eax, 0x4c7
jne 0x4614d5
mov edi, 0x80004005
jmp 0x461504
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x461504
test dword [eax + 0x1c], 0x100
je 0x461504
cmp byte [eax + 0x19], 2
jb 0x461504
push edi
push dword [eax + 0x14]
mov edx, 0x40efb0
push dword [eax + 0x10]
push 0x68
pop ecx
call fcn.00414ccb
mov ebx, dword [ebp - 0x2c]
jmp 0x461593
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x4615ad
mov eax, dword [esi + 0x14]
mov ecx, dword [eax + 0x10]
test ecx, ecx
jne 0x461524
lea ecx, [ebp - 0x28]
mov eax, dword [ebx]
push dword [ebp + 8]
push ecx
mov esi, dword [eax + 0x14]
mov ecx, esi
push ebx
call dword [0x478f64]
call esi
mov edi, eax
test edi, edi
jns 0x461593
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x461593
test dword [eax + 0x1c], 0x100
je 0x461593
cmp byte [eax + 0x19], 2
jb 0x461593
push edi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x69
jmp 0x461588
mov eax, dword [0x475014]
cmp eax, 0x475014
je 0x4615b3
test dword [eax + 0x1c], 0x100
je 0x4615b3
cmp byte [eax + 0x19], 2
jb 0x4615b3
push edi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x6a
mov edx, 0x40efb0
pop ecx
call fcn.00414ccb
test ebx, ebx
je 0x4615a7
mov eax, dword [ebx]
push ebx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x478f64]
call esi
cmp dword [ebp - 0x30], 0
je 0x4615b3
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00468ba0
mov esp, ebp
pop ebp
ret 4
Function at 0x4659fd
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x620
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.00465980
test eax, eax
je 0x465a26
xor eax, eax
inc eax
jmp 0x465b9c
push 0x40f07c
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsContentTypeW]
cmp eax, 1
jne 0x465a3e
xor eax, eax
jmp 0x465b9c
push 0x2e
push esi
call dword [sym.imp.msvcrt.dll_wcsrchr]
mov esi, eax
xor eax, eax
pop ecx
pop ecx
test esi, esi
je 0x465b9c
push ebx
push edi
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x620]
mov ebx, SysReAllocString
mov edi, 0x208
mov dword [ebp - 0x620], edi
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
je 0x465aa6
cmp eax, 0xd
jne 0x465b93
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x620], edi
push eax
push 0x40f090
mov esi, 0x104
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.00416647
add esp, 0x1c
test eax, eax
js 0x465b93
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
je 0x465b2d
cmp eax, 0xd
je 0x465b2d
lea eax, [ebp - 0x20c]
mov edx, esi
push eax
lea ecx, [ebp - 0x414]
call fcn.0041b6c9
test eax, eax
js 0x465b93
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x20c]
push eax
push 0x40f0a4
lea eax, [ebp - 0x61c]
push esi
push eax
call fcn.00416647
add esp, 0x1c
test eax, eax
js 0x465b93
lea eax, [ebp - 0x620]
mov dword [ebp - 0x620], edi
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
je 0x465b97
cmp eax, 0xd
je 0x465b97
xor eax, eax
jmp 0x465b9a
xor eax, eax
inc eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00468ba0
mov esp, ebp
pop ebp
ret