joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4431e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
xor edi, edi
mov dword [esi + 0x6af80], 2
cmp dword [esi + 0x6af90], ebx
je 0x4433e8
cmp dword [esi + 0x6af90], 3
jb 0x443258
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
xor ecx, eax
and ecx, 0x7fff
and edx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
test ebx, ebx
je 0x443295
mov eax, dword [esi + 0x6af84]
sub eax, ebx
cmp eax, 0x7efa
ja 0x443295
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x44327f
mov dword [esi + 0x6afa0], eax
mov edx, ebx
mov ecx, esi
call fcn.00442eb0
mov ecx, dword [esi + 0x6af90]
mov edi, eax
cmp edi, ecx
cmova edi, ecx
mov ecx, esi
cmp edi, 3
jb 0x443368
mov edx, dword [esi + 0x6af84]
lea eax, [edi - 3]
sub edx, dword [esi + 0x6af88]
push eax
call fcn.00442660
sub dword [esi + 0x6af90], edi
add esp, 4
mov dword [ebp - 4], eax
cmp edi, dword [esi + 0x6af98]
ja 0x44332f
cmp dword [esi + 0x6af90], 3
jb 0x44332f
dec edi
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [esi + edx + 0x1af72]
and edx, 0x7fff
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
sub edi, 1
jne 0x4432d3
mov eax, dword [ebp - 4]
jmp 0x443387
add dword [esi + 0x6af84], edi
xor edi, edi
mov eax, dword [esi + 0x6af84]
movzx ecx, byte [eax + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [eax + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov eax, dword [ebp - 4]
jmp 0x44338d
mov eax, dword [esi + 0x6af84]
xor edx, edx
movzx eax, byte [eax + esi + 0x1af70]
push eax
call fcn.00442660
add esp, 4
dec dword [esi + 0x6af90]
inc dword [esi + 0x6af84]
test eax, eax
je 0x4433c8
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x4433a5
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x4433a7
xor edx, edx
mov eax, dword [esi + 0x6af84]
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.004424b0
mov eax, dword [esi + 0x6af84]
add esp, 8
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x4433db
mov ecx, esi
call fcn.00443080
cmp dword [esi + 0x6af90], 0
jne 0x443203
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x4433fc
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x4433fe
xor edx, edx
mov eax, dword [esi + 0x6af84]
sub eax, ecx
mov ecx, esi
push 1
push eax
call fcn.004424b0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4440e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x4440eb
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x4441a7
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x490158]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x490158]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x490158]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x490158]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x490158]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x490158]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x490158]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x490158]
sub edi, 1
jne 0x444100
pop edi
test esi, esi
je 0x4441ca
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x490158]
sub esi, 1
jne 0x4441b0
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x444690
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x18], 0
je 0x444752
mov eax, dword [esi + 0x20]
push ebx
mov ebx, dword [esi + 0x1c]
push edi
mov edi, dword [ebp + 0xc]
add ebx, edi
cmp ebx, eax
jb 0x444731
add eax, eax
push 0
cmp eax, ebx
cmova ebx, eax
push ebx
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x4446f3
push ebx
push 0
push 0
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 4], eax
test eax, eax
jne 0x444701
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov eax, 0x300
pop esi
mov esp, ebp
pop ebp
ret 8
push dword [esi + 0x20]
push dword [esi + 0x18]
push eax
call fcn.0045be40
add esp, 0xc
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x20], ebx
mov dword [esi + 4], eax
mov ecx, dword [esi + 0x1c]
add ecx, dword [esi + 0x18]
push edi
push dword [ebp + 8]
push ecx
call fcn.0045be40
add esp, 0xc
mov eax, edi
add dword [esi + 0x1c], edi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi]
test eax, eax
je 0x44477c
push 0
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret 8
mov dword [esi + 0xc], 0x1000000
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4449f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 0x58]
test edx, edx
je 0x444a47
mov ecx, dword [edi + 0x60]
mov ebx, dword [edi + 0x5c]
cmp ecx, ebx
jae 0x444a8f
mov esi, dword [ebp + 8]
lea eax, [ecx + edx]
sub ebx, ecx
cmp ebx, dword [ebp + 0xc]
cmova ebx, dword [ebp + 0xc]
push ebx
push eax
push esi
call fcn.0045be40
mov ecx, dword [edi + 0x4c]
mov edx, esi
add dword [edi + 0x60], ebx
add dword [edi + 0x48], ebx
push ebx
call fcn.004440e0
add esp, 0x10
mov dword [edi + 0x4c], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 0x50]
test eax, eax
je 0x444a88
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 4]
push 0
push ecx
push dword [ebp + 0xc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x444a8f
mov esi, dword [ebp - 4]
mov edx, ebx
mov ecx, dword [edi + 0x4c]
add dword [edi + 0x48], esi
push esi
call fcn.004440e0
add esp, 4
mov dword [edi + 0x4c], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [edi + 0xc], 0x1000000
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x445cd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x4ac084]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0xa0]
mov dword [ebp - 0x94], 0
push eax
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
mov dword [ebp - 0x90], 4
mov dword [ebp - 0x8c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x445e04
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x8c]
push eax
push 0
push str.Install
push dword [ebp - 0xa0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x445e04
cmp dword [ebp - 0x8c], 4
jne 0x445e04
cmp dword [ebp - 0x94], 1
jne 0x445e04
push 0x80
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.0045b910
add esp, 0xc
mov dword [ebp - 0x90], 0x80
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x8c]
push eax
push 0
push 0x49bafc
push dword [ebp - 0xa0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x445dfc
cmp dword [ebp - 0x8c], 1
jne 0x445dfc
lea eax, [ebp - 0x88]
xorps xmm0, xmm0
push eax
lea ecx, [ebp - 0x9c]
movq qword [ebp - 0x9c], xmm0
call fcn.0044aba0
mov ecx, dword [ebp - 0x9c]
mov eax, esi
mov dword [esi], ecx
mov ecx, dword [ebp - 0x98]
mov dword [esi + 4], ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00458d41
mov esp, ebp
pop ebp
ret
mov dword [esi], 4
jmp 0x445e08
xor eax, eax
mov dword [esi], eax
mov ecx, dword [ebp - 4]
xor eax, eax
mov dword [esi + 4], eax
xor ecx, ebp
mov eax, esi
pop esi
call fcn.00458d41
mov esp, ebp
pop ebp
ret
Function at 0x446030
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4ac084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
push edi
mov edi, dword [ebp + 8]
cmp ebx, reloc.OLEAUT32.dll_SysReAllocString
jne 0x44605e
call fcn.00446340
lea eax, [ebp - 8]
push eax
push 0x20119
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
lea ecx, [ebp - 0x20]
push esi
push edi
push str.RegOpenKeyEx__s_result:__i
push 1
push 3
push 0x80
push str.MigrateReg
push str.Helpers.cpp
call fcn.00457220
push eax
call fcn.004573f0
add esp, 0x18
test esi, esi
je 0x4460b5
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00458d41
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
lea ecx, [ebp - 0x20]
push esi
push dword [ebp - 0x10]
push str.RegOpenKeyEx___s_result:__i
push 1
push 3
push 0x85
push str.MigrateReg
push str.Helpers.cpp
call fcn.00457220
push eax
call fcn.004573f0
add esp, 0x18
test esi, esi
jne 0x4460a2
push esi
push dword [ebp - 0xc]
push esi
push dword [ebp - 8]
call dword [sym.imp.SHLWAPI.dll_SHCopyKeyW]
mov esi, eax
lea ecx, [ebp - 0x20]
push esi
push str.RegCopyTree_result:__i
push 1
push 3
push 0x8a
push str.MigrateReg
push str.Helpers.cpp
call fcn.00457220
push eax
call fcn.004573f0
add esp, 0x14
test esi, esi
jne 0x4460a2
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0xc]
call esi
lea eax, [ebp - 8]
push eax
push 0xf013f
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push edi
push str.RegOpenKeyEx__s_for_deleiting_result:__i
push 1
push 3
push 0x93
push str.MigrateReg
push str.Helpers.cpp
lea ecx, [ebp - 0x20]
call fcn.00457220
push eax
call fcn.004573f0
add esp, 0x18
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
push eax
push str.RegDeleteTree_result:__i
push 1
push 3
push 0x96
push str.MigrateReg
push str.Helpers.cpp
lea ecx, [ebp - 0x20]
call fcn.00457220
push eax
call fcn.004573f0
add esp, 0x14
push dword [ebp - 8]
call esi
push 0
push 0x100
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov esi, eax
lea ecx, [ebp - 0x20]
push esi
push edi
push str.RegDeleteKey__s_result:__i
push 1
push 3
push 0x9b
push str.MigrateReg
push str.Helpers.cpp
call fcn.00457220
push eax
call fcn.004573f0
mov ecx, dword [ebp - 4]
add esp, 0x18
xor eax, eax
test esi, esi
sete al
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00458d41
mov esp, ebp
pop ebp
ret
Function at 0x446230
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4ac084]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 8]
mov edi, ecx
push eax
push 0xf013f
push 0
push str.SOFTWAREKromtech
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
lea ecx, [ebp - 0x14]
push esi
push str.SOFTWAREKromtech
push str.RegOpenKeyEx__s_for_deleting_result:__i
push 1
push 3
push 0xa5
push str.DeleteOldReg
push str.Helpers.cpp
call fcn.00457220
push eax
call fcn.004573f0
add esp, 0x18
test esi, esi
je 0x4462a2
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00458d41
mov esp, ebp
pop ebp
ret
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov esi, eax
lea ecx, [ebp - 0x14]
push esi
push str.RegDeleteTree_result:__i
push 1
push 3
push 0xaa
push str.DeleteOldReg
push str.Helpers.cpp
call fcn.00457220
push eax
call fcn.004573f0
add esp, 0x14
test esi, esi
jne 0x446290
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push 0x100
push str.SOFTWAREKromtech
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov esi, eax
lea ecx, [ebp - 0x14]
push esi
push str.SOFTWAREKromtech
push str.RegDeleteKey__s_result:__i
push 1
push 3
push 0xb1
push str.DeleteOldReg
push str.Helpers.cpp
call fcn.00457220
push eax
call fcn.004573f0
mov ecx, dword [ebp - 4]
add esp, 0x18
xor eax, eax
test esi, esi
sete al
xor ecx, ebp
pop edi
pop esi
call fcn.00458d41
mov esp, ebp
pop ebp
ret

Function at 0x446340
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481328
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4ac084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push 0xf013f
push str.SOFTWAREKromtechPCKAVSettings
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
call fcn.00402f70
mov esi, dword [ebp - 0x1c]
test eax, eax
je 0x4463e5
push str.SOFTWAREKromtechPCKAVSettings
push str.Cant_Open__ls
push 1
push 3
push 0xbd
push str.PreMigrateRegCleanup
push str.Helpers.cpp
lea ecx, [ebp - 0x28]
call fcn.00457220
push eax
call fcn.004573f0
add esp, 0x14
xor bl, bl
jmp 0x446431
push 0x49be94
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x446422
push str.Cant_delete_lu
push 1
push 3
push 0xc3
push str.PreMigrateRegCleanup
push str.Helpers.cpp
lea ecx, [ebp - 0x28]
call fcn.00457220
push eax
call fcn.004573f0
add esp, 0x10
xor bl, bl
jmp 0x446431
test esi, esi
je 0x44642f
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov bl, 1
test esi, esi
je 0x44643c
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00458d41
mov esp, ebp
pop ebp
ret
Function at 0x446460
Capabilities:
Check if file exists
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481366
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x4ac084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x224], ecx
xor bl, bl
call fcn.00403450
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x4464b8
push 0x80004005
call fcn.004039a0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x220], edi
mov dword [ebp - 4], 0
call fcn.00403450
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x4464e9
push 0x80004005
call fcn.004039a0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x21c], esi
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 1
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4465d1
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x220]
call fcn.00408350
push dword [ebp - 0x224]
lea ecx, [ebp - 0x220]
call fcn.00408350
push str.release_notes.txt
lea ecx, [ebp - 0x220]
call fcn.00408350
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.00408350
push dword [ebp - 0x228]
lea ecx, [ebp - 0x21c]
call fcn.00408350
push str.release_notes.txt
lea ecx, [ebp - 0x21c]
call fcn.00408350
mov edi, dword [ebp - 0x220]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, dword [ebp - 0x21c]
test eax, eax
je 0x4465d1
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x4465a5
mov bl, 1
jmp 0x4465d1
push str.Cant_migrate_release_notes.txt
push 1
push 3
push 0xe3
push str.MigrateReleaseNotes
push str.Helpers.cpp
lea ecx, [ebp - 0x234]
call fcn.00457220
push eax
call fcn.004573f0
add esp, 0x10
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4465ef
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], esi
dec esi
test esi, esi
jg 0x44660b
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00458d41
mov esp, ebp
pop ebp
ret
Function at 0x448d90
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48165b
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x4ac084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x448ddd
xor al, al
jmp 0x448eba
push str.kernel32.dll
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.00461656
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
push 2
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeExW]
mov edi, eax
test edi, edi
je 0x448dd6
push 0x4af2ac
push edi
call fcn.0045927b
mov esi, eax
add esp, 8
mov dword [ebp - 0x224], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x448ea7
push esi
push edi
push 0
lea eax, [ebp - 0x218]
push eax
push 2
call dword [sym.imp.VERSION.dll_GetFileVersionInfoExW]
test eax, eax
je 0x448ea7
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x228], 0
push eax
lea eax, [ebp - 0x228]
push eax
push 0x4913ac
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x448ea7
cmp dword [ebp - 0x21c], 0
je 0x448ea7
mov ecx, dword [ebp - 0x228]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._u._u._u._u
push ebx
call fcn.004040a0
add esp, 0x18
mov bl, 1
jmp 0x448ea9
xor bl, bl
test esi, esi
je 0x448eb8
push 1
push esi
call fcn.0045926d
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00458d41
mov esp, ebp
pop ebp
ret
Function at 0x44a1a0
Capabilities:
Encode data using xor
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4ac084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
push edi
push 0x20106
push dword [0x4b0518]
xorps xmm0, xmm0
mov dword [ebp - 8], 0
movq qword [ebp - 0x10], xmm0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call fcn.00402f70
test eax, eax
je 0x44a21e
sub esp, 8
push 0x20106
push 0
push ecx
push dword [0x4b0518]
lea ecx, [ebp - 0x10]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042e8d0
test eax, eax
je 0x44a21e
mov ebx, dword [ebp - 0x10]
xor edi, edi
jmp 0x44a28e
mov ebx, dword [ebx]
lea ecx, [ebp - 0x14]
push esi
mov dword [ebp - 0x14], 0
mov eax, dword [ebx - 0xc]
lea edi, [eax*2 + 6]
push edi
call fcn.00402d50
mov esi, dword [ebp - 0x14]
mov edx, 4
cmp edi, edx
jbe 0x44a261
sub ebx, esi
nop dword [eax]
lea ecx, [edx + esi]
lea eax, [edx - 0x16]
inc edx
xor al, byte [ebx + ecx - 4]
mov byte [ecx], al
cmp edx, edi
jb 0x44a250
mov ebx, dword [ebp - 0x10]
push edi
push esi
push 3
push 0
push str.zi_cid
mov dword [esi], 0
push ebx
mov byte [esi], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
push esi
sbb edi, edi
inc edi
call fcn.00458d52
add esp, 4
pop esi
test ebx, ebx
je 0x44a299
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop ebx
call fcn.00458d41
mov esp, ebp
pop ebp
ret 8
Function at 0x44a2b0
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4817b0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4ac084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ecx, eax
mov dword [ebp - 0x2c], eax
call fcn.00403750
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push 0x20119
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
push dword [0x4b0518]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00402f70
mov ebx, dword [ebp - 0x1c]
test eax, eax
je 0x44a339
xor edi, edi
jmp 0x44a3f3
xor esi, esi
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 1
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
push esi
lea eax, [ebp - 0x28]
mov dword [ebp - 0x20], esi
push eax
push esi
push str.zi_cid
push ebx
call edi
test eax, eax
jne 0x44a367
cmp dword [ebp - 0x28], 3
jmp 0x44a36c
cmp eax, 0xea
jne 0x44a3e8
push dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
call fcn.00402d50
mov esi, dword [ebp - 0x24]
test al, al
je 0x44a3e8
lea eax, [ebp - 0x20]
push eax
push esi
lea eax, [ebp - 0x28]
push eax
push 0
push str.zi_cid
push ebx
call edi
test eax, eax
jne 0x44a3e8
cmp dword [ebp - 0x28], 3
jne 0x44a3e8
mov ecx, dword [ebp - 0x20]
cmp ecx, 5
jb 0x44a3e8
movzx eax, byte [esi]
sub eax, 1
jne 0x44a3e8
mov edx, 4
cmp ecx, edx
jbe 0x44a3c7
mov al, dl
lea ecx, [edx + esi]
sub al, 0x16
inc edx
xor byte [ecx], al
mov ecx, dword [ebp - 0x20]
cmp edx, ecx
jb 0x44a3b6
cmp word [ecx + esi - 2], 0
jne 0x44a3e8
lea eax, [ecx - 4]
mov ecx, dword [ebp - 0x2c]
shr eax, 1
push eax
lea eax, [esi + 4]
push eax
call fcn.00409770
mov edi, 1
jmp 0x44a3ea
xor edi, edi
push esi
call fcn.00458d52
add esp, 4
test ebx, ebx
je 0x44a3fe
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00458d41
mov esp, ebp
pop ebp
ret 4