joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41be60
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esi + 0x44]
mov eax, dword [esi + 0x18]
mov ebx, dword [esi + 0x20]
mov ebp, dword [esi + 0x268]
mov ecx, dword [esi + 0x30]
mov dword [esp + 0x10], eax
cmp edi, 0x2710
jge 0x41be91
push ebp
push edi
push eax
jmp 0x41bf6b
lea eax, [edi + 0x22]
test al, 1
lea edx, [eax + 1]
cmove edx, eax
add edx, dword [esi + 0x24]
mov dword [esp + 0x14], edx
cmp ecx, 1
jge 0x41beaf
mov ecx, 1
jmp 0x41beb9
mov eax, 0x64
cmp ecx, eax
cmovg ecx, eax
dec ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
push ebp
push edi
push dword [esp + 0x1c]
push dword [esp + 0x24]
push dword [esi + 0x24]
push ebx
call fcn.0041cf90
mov eax, dword [esp + 0x3c]
add esp, 0x1c
cmp ebp, 3
jl 0x41bf44
mov ecx, dword [esp + 0x18]
mov edx, 1
sub ecx, eax
test edi, edi
mov eax, edi
cmove eax, edx
sub esp, 8
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
divss xmm1, xmm0
cvtps2pd xmm0, xmm1
movsd qword [esp], xmm0
push edi
push ecx
push str._______d_work___d_block__ratio__5.2f_n
push 2
call fcn.0046c767
add esp, 4
push eax
call fcn.0040bf20
mov eax, dword [esp + 0x38]
add esp, 0x18
test eax, eax
jns 0x41bf79
cmp ebp, 2
jl 0x41bf65
push str.____too_repetitive__using_fallback_sorting_algorithm_n
push 2
call fcn.0046c767
add esp, 4
push eax
call fcn.0040bf20
add esp, 8
push ebp
push edi
push dword [esp + 0x18]
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.0041c2f0
add esp, 0x14
mov ecx, dword [esi + 0x44]
xor eax, eax
mov dword [esi + 0x1c], 0xffffffff
test ecx, ecx
jle 0x41bfa0
nop dword [eax]
cmp dword [ebx + eax*4], 0
je 0x41bf9d
inc eax
cmp eax, ecx
jl 0x41bf90
jmp 0x41bfa0
mov dword [esi + 0x1c], eax
cmp dword [esi + 0x1c], 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
jne 0x41bfba
add esp, 0xc
mov dword [esp + 4], 0x3eb
jmp fcn.00414a40
add esp, 0xc
ret
Function at 0x41f7d0
Capabilities:
Compute adler32 checksum

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
movzx ecx, si
shr esi, 0x10
test edi, edi
jne 0x41f7ea
lea eax, [edi + 1]
pop edi
pop esi
ret
push ebp
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x41f8ec
push ebx
nop dword [eax + eax]
mov edx, 0x15b0
cmp ebp, edx
cmovb edx, ebp
sub ebp, edx
cmp edx, 0x10
jl 0x41f8ae
mov ebx, edx
shr ebx, 4
mov eax, ebx
neg eax
shl eax, 4
add edx, eax
movzx eax, byte [edi]
add ecx, eax
movzx eax, byte [edi + 1]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 2]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 3]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 4]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 5]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 6]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 7]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 8]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 9]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xa]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xb]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xc]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xd]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xe]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xf]
add esi, ecx
add edi, 0x10
add ecx, eax
add esi, ecx
sub ebx, 1
jne 0x41f823
test edx, edx
je 0x41f8bf
movzx eax, byte [edi]
inc edi
add ecx, eax
add esi, ecx
sub edx, 1
jne 0x41f8b2
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul esi
shr edx, 0xf
imul edx, edx, 0xffff000f
add esi, edx
test ebp, ebp
jne 0x41f800
pop ebx
shl esi, 0x10
pop ebp
or esi, ecx
pop edi
mov eax, esi
pop esi
ret
Function at 0x4254b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x487bbf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, ecx
push ebx
push esi
mov dword [ebp - 0x14], eax
mov eax, dword [eax + 0x44]
push edi
push 0x48fa30
push 3
mov edx, dword [eax]
push eax
call dword [edx + 0x14]
mov edi, dword [ebp + 8]
add esp, 0xc
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov eax, dword [edi + 0xc]
cmp eax, dword [ebx + 0xc]
jne 0x4255de
call fcn.0045fa3f
push 0x14
mov dword [ebp - 0x1c], eax
call fcn.00453c80
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 4], esi
test eax, eax
je 0x425524
push dword [edi + 0xc]
mov ecx, eax
call fcn.0040ca40
mov esi, eax
jmp 0x425526
xor esi, esi
mov dword [ebp - 4], 0xffffffff
xor edx, edx
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0xc]
shr eax, 2
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], eax
mov dword [ebp + 8], edx
test eax, eax
je 0x425582
nop dword [eax]
mov eax, dword [ebx + 8]
mov ecx, dword [edi + 8]
mov edx, dword [eax + edx*4]
mov eax, dword [ebp + 8]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 8]
mov dword [eax + ecx*4], edx
inc ecx
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp + 8], ecx
test edx, edx
mov edx, ecx
cmove eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
cmp ecx, eax
jb 0x425550
mov ecx, dword [edi + 0xc]
shl eax, 2
sub ecx, eax
mov dword [ebp + 8], ecx
cmp eax, ecx
jae 0x4255ac
mov ecx, dword [edi + 8]
mov edx, dword [ebx + 8]
mov bl, byte [ecx + eax]
xor bl, byte [edx + eax]
mov ecx, dword [esi + 8]
mov byte [eax + ecx], bl
inc eax
mov ebx, dword [ebp + 0xc]
cmp eax, dword [ebp + 8]
jb 0x425591
call fcn.0045fa3f
mov edi, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x10]
push eax
mov ecx, dword [edi + 0x44]
push ebx
push str.screens_differences:__d__comparison_time:__d_ms_n
push ecx
mov edx, dword [ecx]
call dword [edx + 0x18]
add esp, 0x10
cmp ebx, dword [ebp + 0x10]
jge 0x4255e1
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
xor esi, esi
jmp 0x4255e1
mov edi, dword [ebp - 0x14]
mov ecx, dword [edi + 0x44]
push str._compareScreens_n
push 3
push ecx
mov edx, dword [ecx]
call dword [edx + 0x14]
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4259c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x487cc2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.00429e3f
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov byte [ebp - 4], 3
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov byte [ebp - 4], 4
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov byte [ebp - 4], 5
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
mov eax, dword [ebp + 8]
test eax, eax
jne 0x425a8b
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.0045745f
add esp, 8
mov byte [ebp - 4], 7
mov dword [ebp - 0x24], vtable.std::runtime_error.0
mov byte [ebp - 4], 6
lea eax, [ebp - 0x24]
push 0x4b89bc
push eax
call fcn.00456134
push eax
push esi
call fcn.0042a3eb
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x452a00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4893b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
xor eax, eax
mov dword [ebp - 0x2c], 7
push esi
mov esi, ecx
mov dword [ebp - 0x30], 0
xor bl, bl
mov word [ebp - 0x40], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x40]
push eax
lea eax, [esi + 4]
push eax
call fcn.00483bd0
add esp, 8
lea eax, [ebp - 0x10]
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x40]
push eax
mov eax, dword [esi + 0x24]
or eax, 0x20019
push eax
push 0
push ecx
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x452ad0
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], eax
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
push dword [ebp + 8]
call fcn.00483bd0
add esp, 8
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push 0
push 0
push 0
push 0
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
test eax, eax
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x452ad0
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.0042a803
mov ecx, dword [ebp - 0x2c]
cmp ecx, 8
jb 0x452ae5
inc ecx
push ecx
push dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
call fcn.0042a803
mov ecx, dword [ebp - 0xc]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x452b00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4893e9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
call fcn.00453620
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
xor eax, eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], 0
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 1
push eax
push dword [ebp + 0xc]
call fcn.00483bd0
add esp, 8
lea ecx, [ebp - 0x10]
cmp dword [ebp - 0x1c], 8
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
push ecx
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0
push eax
push dword [edi + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x452bfc
cmp dword [ebp - 0x18], 3
jne 0x452bfc
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x452bd3
push eax
mov ecx, esi
call fcn.00453770
cmp dword [ebp - 0x1c], 8
lea ecx, [ebp - 0x10]
push ecx
push dword [esi]
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
push 0
push 0
push eax
push dword [edi + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x1c]
cmp ecx, 8
jb 0x452be8
inc ecx
push ecx
push dword [ebp - 0x30]
lea ecx, [ebp - 0x30]
call fcn.0042a803
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push dword [ebp + 0xc]
lea eax, [ebp - 0x48]
mov ecx, edi
push eax
call fcn.00453490
push 0
push eax
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 2
call fcn.0042f8c0
push 0x4bba74
lea eax, [ebp - 0x74]
push eax
call fcn.00456134
int3

Function at 0x452c30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x489410
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6c
push esi
push edi
mov esi, ecx
call fcn.00453620
xor eax, eax
mov dword [ebp - 0x10], 8
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x24], 0
mov word [ebp - 0x34], ax
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x34]
push eax
push edi
call fcn.00483bd0
add esp, 8
lea ecx, [ebp - 0x10]
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
cmovae eax, dword [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push 0
push eax
push dword [esi + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x452ce0
cmp dword [ebp - 0x14], 0xb
jne 0x452ce0
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x18]
cmp ecx, 8
jb 0x452cca
inc ecx
push ecx
push dword [ebp - 0x34]
lea ecx, [ebp - 0x34]
call fcn.0042a803
mov ecx, dword [ebp - 0xc]
mov edx, edi
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push edi
lea eax, [ebp - 0x4c]
mov ecx, esi
push eax
call fcn.00453490
push 0
push eax
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 1
call fcn.0042f8c0
push 0x4bba74
lea eax, [ebp - 0x78]
push eax
call fcn.00456134
int3
Function at 0x452d10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x489430
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push esi
mov esi, ecx
call fcn.00453620
xor eax, eax
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], 0
mov word [ebp - 0x30], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
call fcn.00483bd0
add esp, 8
lea ecx, [ebp - 0x10]
cmp dword [ebp - 0x1c], 8
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push 0
push eax
push dword [esi + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x452dbf
mov eax, dword [ebp - 0x14]
cmp eax, 4
je 0x452d94
cmp eax, 5
jne 0x452dbf
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
cmp ecx, 8
jb 0x452dac
inc ecx
push ecx
push dword [ebp - 0x30]
lea ecx, [ebp - 0x30]
call fcn.0042a803
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
push dword [ebp + 8]
lea eax, [ebp - 0x48]
mov ecx, esi
push eax
call fcn.00453490
push 0
push eax
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 1
call fcn.0042f8c0
push 0x4bba74
lea eax, [ebp - 0x74]
push eax
call fcn.00456134
int3
Function at 0x452df0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48946e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7c
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x1c], 0
push edi
mov dword [ebp - 0x18], ebx
call fcn.00453620
xor eax, eax
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], 0
mov word [ebp - 0x44], ax
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.00483bd0
add esp, 8
lea ecx, [ebp - 0x10]
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push ecx
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0
push eax
push dword [ebx + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x452ffd
mov eax, dword [ebp - 0x14]
cmp eax, 1
je 0x452e85
cmp eax, 2
je 0x452e85
cmp eax, 6
jne 0x452ffd
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x452fe7
shr edi, 1
xor ecx, ecx
mov edx, 2
mov byte [ebp - 0x20], 1
lea esi, [edi + 1]
mov eax, esi
mov dword [ebp - 0x2c], esi
mul edx
mov dword [ebp - 0x28], esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00454697
mov ebx, eax
add esp, 4
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x44]
cmovae ecx, dword [ebp - 0x44]
push ebx
push 0
push 0
push ecx
push dword [eax + 0x1c]
mov byte [ebp - 4], 2
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp edi, esi
jb 0x452f01
push 0
push 0x130
push str...FoundationincludePoco_Buffer.h
push str.index____used
call fcn.0042e650
add esp, 0x10
xor eax, eax
lea ecx, [ebp - 0x88]
push ebx
mov word [ebx + edi*2], ax
call fcn.0042d907
mov dword [ebp - 0x48], 0xf
mov dword [ebp - 0x4c], 0
mov byte [ebp - 0x5c], 0
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.00483ce0
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x5c]
add esp, 8
mov ecx, esi
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
push eax
mov byte [esi], 0
call fcn.00406c60
mov eax, dword [ebp - 0x48]
cmp eax, 0x10
jb 0x452f70
inc eax
lea ecx, [ebp - 0x5c]
push eax
push dword [ebp - 0x5c]
call fcn.00401a60
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x48], 0xf
mov dword [ebp - 0x4c], 0
mov byte [ebp - 0x5c], 0
cmp eax, 8
jb 0x452f9d
inc eax
lea ecx, [ebp - 0x88]
push eax
push dword [ebp - 0x88]
call fcn.0042a803
xor eax, eax
mov dword [ebp - 0x74], 7
push ebx
mov dword [ebp - 0x78], 0
mov word [ebp - 0x88], ax
call fcn.004546a0
add esp, 4
mov ecx, dword [ebp - 0x30]
cmp ecx, 8
jb 0x452fd2
inc ecx
push ecx
push dword [ebp - 0x44]
lea ecx, [ebp - 0x44]
call fcn.0042a803
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [ebp + 8]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
jmp 0x452fbd
push esi
lea eax, [ebp - 0x88]
mov ecx, ebx
push eax
call fcn.00453490
push 0
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 1
call fcn.0042f8c0
push 0x4bba74
lea eax, [ebp - 0x70]
push eax
call fcn.00456134
int3
Function at 0x4537c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x489510
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push esi
mov esi, ecx
call fcn.00453620
xor eax, eax
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x2c], 0
mov word [ebp - 0x3c], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 8]
call fcn.00483bd0
xor eax, eax
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 1
push eax
push dword [ebp + 0xc]
call fcn.00483bd0
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x24]
add esp, 0x10
lea ecx, [ebp - 0x3c]
cmp dword [ebp - 0x10], 8
cmovae edx, dword [ebp - 0x24]
lea eax, [eax*2 + 2]
cmp dword [ebp - 0x28], 8
push eax
cmovae ecx, dword [ebp - 0x3c]
push edx
push 1
push 0
push ecx
push dword [esi + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x45386b
push dword [ebp + 8]
mov ecx, esi
call fcn.00453410
mov eax, dword [ebp - 0x10]
pop esi
cmp eax, 8
jb 0x453881
inc eax
lea ecx, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
call fcn.0042a803
xor eax, eax
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], 0
cmp eax, 8
jb 0x4538aa
inc eax
lea ecx, [ebp - 0x3c]
push eax
push dword [ebp - 0x3c]
call fcn.0042a803
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x4538c0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x489530
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x23c
push edi
mov edi, ecx
call fcn.00453620
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], 0
push eax
push 0
push 0
push 0
push dword [edi + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x453a2f
push esi
xor esi, esi
mov dword [ebp - 0x14], 0x100
cmp dword [ebp - 0x10], esi
jbe 0x453a2e
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
nop dword [eax]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x248]
push eax
push esi
push dword [edi + 0x1c]
call ebx
test eax, eax
jne 0x453a1c
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x38], eax
mov word [ebp - 0x48], ax
cmp word [ebp - 0x248], ax
je 0x453990
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x453981
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x48]
call fcn.0042da6a
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0xf
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x30], 0
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00483ce0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x30]
add esp, 8
push eax
call fcn.00429b30
mov eax, dword [ebp - 0x1c]
cmp eax, 0x10
jb 0x4539ee
inc eax
lea ecx, [ebp - 0x30]
push eax
push dword [ebp - 0x30]
call fcn.00401a60
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], 0xf
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x30], 0
mov dword [ebp - 4], 0xffffffff
cmp eax, 8
jb 0x453a1c
inc eax
lea ecx, [ebp - 0x48]
push eax
push dword [ebp - 0x48]
call fcn.0042a803
inc esi
mov dword [ebp - 0x14], 0x100
cmp esi, dword [ebp - 0x10]
jb 0x453940
pop ebx
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x453a40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x489550
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
call fcn.00453620
xor eax, eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 8]
call fcn.00483bd0
add esp, 8
lea ecx, [ebp - 0x14]
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push ecx
push 0
lea ecx, [ebp - 0x10]
push ecx
push 0
push eax
push dword [esi + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x453ae0
push dword [ebp + 8]
lea eax, [ebp - 0x44]
mov ecx, esi
push eax
call fcn.00453490
push 0
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 1
call fcn.0042f8c0
push 0x4bba74
lea eax, [ebp - 0x70]
push eax
call fcn.00456134
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
cmp ecx, 8
jb 0x453af8
inc ecx
push ecx
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
call fcn.0042a803
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x453b10
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x489570
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x238
push edi
mov edi, ecx
call fcn.00453620
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [edi + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x453c6f
push esi
xor esi, esi
mov dword [ebp - 0x14], 0x100
cmp dword [ebp - 0x10], esi
jbe 0x453c6e
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x244]
push eax
push esi
push dword [edi + 0x1c]
call ebx
test eax, eax
jne 0x453c5c
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], eax
mov word [ebp - 0x44], ax
cmp word [ebp - 0x244], ax
je 0x453bd0
lea eax, [ebp - 0x244]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x453bc1
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x44]
call fcn.0042da6a
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00483ce0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x2c]
add esp, 8
push eax
call fcn.00429b30
mov eax, dword [ebp - 0x18]
cmp eax, 0x10
jb 0x453c2e
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00401a60
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
mov dword [ebp - 4], 0xffffffff
cmp eax, 8
jb 0x453c5c
inc eax
lea ecx, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
call fcn.0042a803
inc esi
mov dword [ebp - 0x14], 0x100
cmp esi, dword [ebp - 0x10]
jb 0x453b80
pop ebx
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x4694ba
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046937d

Function at 0x474c5f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00474ade

Function at 0x478419
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004780d9