joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468ac0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55403b
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x5c5244]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
test esi, esi
je 0x468af8
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00469880
add esp, 8
mov byte [ebp - 4], 1
mov ebx, dword [ebp - 0x30]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
test ebx, ebx
je 0x468b35
lock inc dword [ebx + 4]
mov ebx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x28], ebx
mov byte [ebp - 4], 3
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x28]
inc eax
cmp ecx, eax
ja 0x468b5d
push 1
lea ecx, [esi + 0x20]
call fcn.0047d4f0
mov ecx, dword [esi + 0x28]
lea eax, [ecx - 1]
and dword [esi + 0x2c], eax
mov eax, dword [esi + 0x30]
add eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
dec ecx
and ecx, eax
cmp dword [edx + ecx*4], 0
lea eax, [ecx*4]
mov dword [ebp + 8], eax
jne 0x468b9b
push 0x28
call fcn.004d9f7d
mov edx, dword [ebp + 8]
add esp, 4
mov ecx, dword [esi + 0x24]
mov dword [edx + ecx], eax
mov edx, dword [esi + 0x24]
mov eax, dword [ebp + 8]
mov edx, dword [eax + edx]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp + 8], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov byte [ebp - 4], 5
mov dword [edx + 0x24], 0
mov byte [ebp - 4], 6
lea ecx, [edx + 4]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x24]
mov dword [edx], vtable.std::_Func_impl_no_alloc_class__lambda_295ffcc1bdc738eae0d634f555ab7e85___void___.0
mov dword [ecx], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], edx
mov dword [ecx + 4], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov byte [ebp - 4], 6
mov dword [edx + 0x24], edx
mov byte [ebp - 4], 3
inc dword [esi + 0x30]
mov byte [ebp - 4], 1
cmp dword [esi + 0x18], 0
jne 0x468c3c
lea eax, [esi + 0x1c]
push eax
push 0
push esi
push 0x47b6d0
push 0
push 0
call fcn.00510ce2
add esp, 0x18
mov dword [esi + 0x18], eax
mov byte [ebp + 0xb], 1
jmp 0x468c40
mov byte [ebp + 0xb], 0
mov byte [ebp - 4], 0
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x468c6c
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [edi + 4], eax
jne 0x468c6c
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lock xadd dword [edi + 8], ebx
dec ebx
jne 0x468c6c
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 4]
mov dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, byte [ebp + 0xb]
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46c8e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5554c8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5c5244]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0xc], 0
jne 0x46c928
push 0
push str.LdsCheck360LockWndClass
call dword [sym.imp.USER32.dll_FindWindowW]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x46ca2e
call fcn.0042df90
mov ecx, eax
call fcn.0044a770
mov ebx, eax
test ebx, ebx
je 0x46ca2e
call fcn.00430a50
mov ecx, eax
test ecx, ecx
je 0x46ca70
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
lea eax, [ebp - 0x10]
push eax
call fcn.00428a60
mov ecx, eax
call fcn.00428f70
cmp dword [0x5c4764], 0
mov edi, eax
je 0x46c986
mov dword [0x5c4764], 0
jmp 0x46c9c5
push edi
mov ecx, ebx
call fcn.00448a80
push edi
push str.DoCheck360HomePageLock_lu
call fcn.00492250
add esp, 8
mov ecx, 0x571e24
test edi, edi
mov eax, 0x571af8
cmove eax, ecx
push 2
push eax
push 1
push str.360lock
push str.SOFTWARELudashi
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
or esi, 0xffffffff
test edi, edi
je 0x46ca0f
lea ecx, [ebp + 0xc]
call fcn.004426c0
mov byte [ebp - 4], 2
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0045ebb0
mov eax, dword [ebp + 0xc]
add esp, 8
cmp dword [eax - 0xc], 0
jne 0x46ca42
mov byte [ebp - 4], 1
mov eax, esi
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x46ca0f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x46ca2e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp + 0xc]
mov ecx, ebx
push eax
call fcn.00448540
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov edx, dword [ebp + 0xc]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x46ca6e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x46ca0f
push 0x80004005
call fcn.004225f0
int3
Function at 0x46e730
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x555939
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x5c5244]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
mov dword [ebp - 0x22c], edi
push eax
mov dword [ebp - 0x220], 0
call fcn.004f39e0
add esp, 0xc
call fcn.00430a50
mov ecx, eax
test ecx, ecx
je 0x46e904
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x21c]
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360wpapp.exe
call fcn.0042d870
test al, al
jne 0x46e7d0
push 0x40
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360wpapp.exe
lea ecx, [ebp - 0x21c]
call fcn.00429710
mov dword [ebp - 4], 2
lea eax, [ebp - 0x224]
mov esi, dword [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x228], 1
push eax
lea eax, [ebp - 0x228]
mov dword [ebp - 0x224], 0x208
push eax
push str.Path
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [ebp - 0x218], 0
je 0x46e87d
push str.Utilsmininews.exe
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46e87d
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
call fcn.0042b850
mov dword [ebp - 0x220], 1
mov dword [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x46e8e5
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x46e8e5
call fcn.00430a50
mov ecx, eax
test ecx, ecx
je 0x46e90e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 4
mov ecx, edi
push 0x56c9a8
call fcn.0042d870
test al, al
jne 0x46e8b8
push 0
push 0x56c9a8
mov ecx, edi
call fcn.00429710
mov byte [ebp - 4], 2
mov dword [ebp - 0x220], 1
mov dword [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x46e8e5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.004225f0
push 0x80004005
call fcn.004225f0
int3
Function at 0x46e920
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x555980
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x5c5244]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ecx + 8]
lea eax, [ebp - 0x14]
push 0
push dword [ecx + 0x34]
push eax
call fcn.00470130
mov dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 4
push eax
push str.test_check_repop_timer_seconds
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x46e9b7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
imul eax, esi, 0x3e8
mov ecx, 0x36ee80
test eax, eax
cmove eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x46e9e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5559e3
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x5c5244]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 0
mov esi, dword [ebp + 8]
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x220], 0
call fcn.00430a50
mov ecx, eax
test ecx, ecx
je 0x46eb32
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x21c]
push 0
push dword [ebp + 0xc]
mov ecx, edi
mov dword [ebp - 0x220], 1
push eax
call fcn.00470130
mov dword [ebp - 4], 2
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
call fcn.004f39e0
add esp, 0xc
mov dword [ebp - 0x228], 1
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], 0x208
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x228]
push eax
push str.CloseTime
push dword [ebp - 0x21c]
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x46eaee
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46ead0
sub eax, edx
mov ecx, esi
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00429710
mov dword [ebp - 4], 0
or eax, 0xffffffff
mov edi, dword [ebp - 0x21c]
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x46eb13
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.004225f0
int3
Function at 0x46ecb0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5c5244]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x46ed28
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
push 0x572b20
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 2
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x18]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret

Function at 0x46ed40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x555a80
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x5c5244]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push dword [ecx + 0x34]
lea eax, [ebp - 0x14]
push eax
call fcn.00470130
mov dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 4
push eax
push str.default_repop_go_on
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x46edd4
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x46edf0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x555af9
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x5c5244]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
mov dword [ebp - 0x22c], edi
push eax
mov dword [ebp - 0x220], 0
call fcn.004f39e0
add esp, 0xc
call fcn.00430a50
mov ecx, eax
test ecx, ecx
je 0x46efc4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x21c]
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360Desktop.exe
call fcn.0042d870
test al, al
jne 0x46ee90
push 0x42
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360Desktop.exe
lea ecx, [ebp - 0x21c]
call fcn.00429710
mov dword [ebp - 4], 2
lea eax, [ebp - 0x224]
mov esi, dword [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x228], 1
push eax
lea eax, [ebp - 0x228]
mov dword [ebp - 0x224], 0x208
push eax
push str.Path
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [ebp - 0x218], 0
je 0x46ef3d
push str.BinUtilsmininews.exe
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46ef3d
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
call fcn.0042b850
mov dword [ebp - 0x220], 1
mov dword [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x46efa5
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x46efa5
call fcn.00430a50
mov ecx, eax
test ecx, ecx
je 0x46efce
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 4
mov ecx, edi
push 0x56c9a8
call fcn.0042d870
test al, al
jne 0x46ef78
push 0
push 0x56c9a8
mov ecx, edi
call fcn.00429710
mov byte [ebp - 4], 2
mov dword [ebp - 0x220], 1
mov dword [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x46efa5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.004225f0
push 0x80004005
call fcn.004225f0
int3
Function at 0x46f730
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x555d39
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x5c5244]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x22c], esi
push 0
mov dword [ebp - 0x220], 0
push dword [ecx + 0x34]
push eax
call fcn.00470130
mov dword [ebp - 4], 1
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
call fcn.004f39e0
add esp, 0xc
mov dword [ebp - 0x228], 1
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], 0x208
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x228]
push eax
push str.latest_click
push dword [ebp - 0x21c]
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x46f873
call fcn.00430a50
mov ecx, eax
test ecx, ecx
je 0x46f900
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.0042d870
test al, al
jne 0x46f83e
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46f820
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00429710
mov byte [ebp - 4], 1
mov dword [ebp - 0x220], 1
mov dword [ebp - 4], 0
or eax, 0xffffffff
mov edi, dword [ebp - 0x21c]
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x46f8e1
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x46f8e1
call fcn.00430a50
mov ecx, eax
test ecx, ecx
je 0x46f90a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 4
mov ecx, esi
push 0x56c9a8
call fcn.0042d870
test al, al
jne 0x46f8ae
push 0
push 0x56c9a8
mov ecx, esi
call fcn.00429710
mov byte [ebp - 4], 1
mov dword [ebp - 0x220], 1
mov dword [ebp - 4], 0
or eax, 0xffffffff
mov edx, dword [ebp - 0x21c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x46f8e1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.004225f0
push 0x80004005
call fcn.004225f0
int3
Function at 0x46f920
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x555dc9
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x5c5244]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
mov dword [ebp - 0x22c], edi
push eax
mov dword [ebp - 0x220], 0
call fcn.004f39e0
add esp, 0xc
call fcn.00430a50
mov ecx, eax
test ecx, ecx
je 0x46faf4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x21c]
push str.SOFTWARELuDaShi
call fcn.0042d870
test al, al
jne 0x46f9c0
push 0x10
push str.SOFTWARELuDaShi
lea ecx, [ebp - 0x21c]
call fcn.00429710
mov dword [ebp - 4], 2
lea eax, [ebp - 0x224]
mov esi, dword [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x228], 1
push eax
lea eax, [ebp - 0x228]
mov dword [ebp - 0x224], 0x208
push eax
push str.Setup_Path
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [ebp - 0x218], 0
je 0x46fa6d
push str.Utilsmininews.exe
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46fa6d
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
call fcn.0042b850
mov dword [ebp - 0x220], 1
mov dword [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x46fad5
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x46fad5
call fcn.00430a50
mov ecx, eax
test ecx, ecx
je 0x46fafe
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 4
mov ecx, edi
push 0x56c9a8
call fcn.0042d870
test al, al
jne 0x46faa8
push 0
push 0x56c9a8
mov ecx, edi
call fcn.00429710
mov byte [ebp - 4], 2
mov dword [ebp - 0x220], 1
mov dword [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x46fad5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.004225f0
push 0x80004005
call fcn.004225f0
int3
Function at 0x46fb10
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x555e59
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x5c5244]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
mov dword [ebp - 0x22c], edi
push eax
mov dword [ebp - 0x220], 0
call fcn.004f39e0
add esp, 0xc
call fcn.00430a50
mov ecx, eax
test ecx, ecx
je 0x46fce4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x21c]
push str.SOFTWARELdsLite
call fcn.0042d870
test al, al
jne 0x46fbb0
push 0x10
push str.SOFTWARELdsLite
lea ecx, [ebp - 0x21c]
call fcn.00429710
mov dword [ebp - 4], 2
lea eax, [ebp - 0x224]
mov esi, dword [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x228], 1
push eax
lea eax, [ebp - 0x228]
mov dword [ebp - 0x224], 0x208
push eax
push str.Setup_Path
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [ebp - 0x218], 0
je 0x46fc5d
push str.Utilsmininews.exe
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46fc5d
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
call fcn.0042b850
mov dword [ebp - 0x220], 1
mov dword [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x46fcc5
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x46fcc5
call fcn.00430a50
mov ecx, eax
test ecx, ecx
je 0x46fcee
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 4
mov ecx, edi
push 0x56c9a8
call fcn.0042d870
test al, al
jne 0x46fc98
push 0
push 0x56c9a8
mov ecx, edi
call fcn.00429710
mov byte [ebp - 4], 2
mov dword [ebp - 0x220], 1
mov dword [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x46fcc5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.004225f0
push 0x80004005
call fcn.004225f0
int3
Function at 0x46ff60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x555f80
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x5c5244]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push dword [ecx + 0x34]
lea eax, [ebp - 0x14]
push eax
call fcn.00470130
mov dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 4
push eax
push str.repop_interval
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x46fff4
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret