joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426349
Capabilities:
Set file attributes

Disassembly:
push 0xc
mov eax, 0x4ba87e
call fcn.004a27f3
push dword [ebp + 0x10]
lea ecx, [ebp - 0x10]
call fcn.00423442
and dword [ebp - 4], 0
push 0x5c
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
call fcn.00423ad0
lea eax, [ebp - 0x14]
push eax
call fcn.004623a0
add esp, 8
mov dword [ebp - 0x18], esp
mov edi, esp
push ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 1
call fcn.00423ad0
call fcn.0047aa60
pop ecx
call fcn.00464810
cmp dword [ebp + 0x18], 0
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop ecx
mov dword [ebp - 0x18], eax
jne 0x426461
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp + 0x18], esp
mov ecx, esp
push eax
call fcn.00423ad0
lea esi, [ebp + 0x18]
call fcn.004624d0
pop ecx
mov edx, dword [ebp + 0xc]
mov byte [ebp - 4], 2
push dword [eax]
mov eax, dword [ebp + 8]
call fcn.00477680
pop ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0x18]
add ecx, 0xfffffff0
mov esi, eax
call fcn.0042101a
cmp esi, 0x200
jne 0x426476
push 0
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp + 0x18], esp
mov ecx, esp
push eax
call fcn.00423ad0
lea edi, [ebp + 0x18]
call fcn.0047aa60
pop ecx
push dword [eax]
call ebx
mov ecx, dword [ebp + 0x18]
add ecx, 0xfffffff0
call fcn.0042101a
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp + 0x18], esp
mov ecx, esp
push eax
call fcn.00423ad0
lea esi, [ebp + 0x18]
call fcn.004624d0
pop ecx
mov edx, dword [ebp + 0xc]
mov byte [ebp - 4], 3
push dword [eax]
mov eax, dword [ebp + 8]
call fcn.00477680
pop ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0x18]
add ecx, 0xfffffff0
mov esi, eax
call fcn.0042101a
jmp 0x426476
push dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
call fcn.004776c0
pop ecx
pop ecx
mov esi, eax
test esi, esi
jne 0x4264bb
cmp dword [ebp + 0x14], esi
je 0x4264a9
push dword [ebp + 0x14]
lea eax, [ebp - 0x10]
push ecx
mov dword [ebp + 0x18], esp
mov ecx, esp
push eax
call fcn.00423ad0
lea edi, [ebp + 0x18]
call fcn.0047aa60
pop ecx
push dword [eax]
call ebx
mov ecx, dword [ebp + 0x18]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [ebp - 0x18], 0
jne 0x4264bb
push 1
push dword [ebp - 0x14]
call fcn.0046d700
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, esi
call fcn.004a28cb
ret
Function at 0x4273cd
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x14
mov eax, 0x4ba285
call fcn.004a27f3
push dword [ebp + 0xc]
xor ebx, ebx
lea ecx, [ebp - 0x14]
mov byte [ebp - 0xd], bl
call fcn.00423442
push str.VirtApp.ini
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.00427b99
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x42746d
push ebx
push edi
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea eax, [esi + 2]
push 1
push eax
call fcn.0049e183
pop ecx
pop ecx
push ebx
lea ecx, [ebp - 0x1c]
push ecx
push esi
push eax
push edi
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
shr esi, 1
push esi
push dword [ebp - 0x18]
push dword [ebp + 8]
call fcn.004264f0
add esp, 0xc
test al, al
je 0x427464
mov byte [ebp - 0xd], 1
push dword [ebp - 0x18]
call fcn.0049e0f5
pop ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0042101a
mov al, byte [ebp - 0xd]
call fcn.004a28cb
ret

Function at 0x427744
Capabilities:
Enumerate files on windows

Disassembly:
push 0x264
mov eax, 0x4b67cf
call fcn.004a285c
push 0x24c
lea eax, [ebp - 0x25c]
push 0
mov dword [ebp - 4], 1
and dword [ebp - 0x260], 0
push eax
call fcn.0049e2e0
push dword [ebp + 8]
lea eax, [ebp - 0x26c]
push str._s..stamp
push eax
call fcn.00461d60
mov eax, dword [eax]
add esp, 0x18
lea ecx, [ebp - 0x260]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x26c]
add ecx, 0xfffffff0
mov esi, eax
call fcn.0042101a
cmp esi, 0xffffffff
je 0x427842
push ecx
mov dword [ebp - 0x268], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [ebp - 0x268], esp
push 0x4c2ec8
call fcn.00423442
push ecx
mov byte [ebp - 4], 2
lea eax, [ebp - 0x234]
mov ecx, esp
mov dword [ebp - 0x270], esp
push eax
call fcn.00423442
push ecx
mov dword [ebp - 0x264], esp
mov ebx, esp
push 0x5c
push ecx
lea eax, [ebp + 8]
mov dword [ebp - 0x264], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 3
call fcn.00423ad0
push ebx
call fcn.004623a0
add esp, 0xc
mov byte [ebp - 4], 1
call fcn.004618b0
add esp, 0xc
call fcn.00465470
pop ecx
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4277b4
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x4c4fbc
push ecx
lea eax, [ebp + 0xc]
mov dword [ebp - 0x264], esp
mov ecx, esp
push eax
xor edi, edi
call fcn.00423ad0
call fcn.00462b40
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0042101a
call fcn.004a28df
ret
Function at 0x4288f5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x10
mov eax, 0x4b9958
call fcn.004a27f3
lea eax, [ebp + 8]
xor ebx, ebx
push eax
mov ecx, 0x4ea98c
mov dword [ebp - 4], ebx
call fcn.00423af1
lea eax, [ebp + 8]
mov esi, 0x4ea798
push eax
mov ecx, esi
call fcn.00423af1
push 1
push ecx
mov dword [ebp - 0x14], esp
mov ecx, esp
push esi
call fcn.00423ad0
lea edi, [ebp - 0x14]
call fcn.00461c70
pop ecx
pop ecx
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00423af1
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0042101a
push 1
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.004235ea
mov edi, 0x4c2ec8
push edi
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.004239fb
test eax, eax
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x14]
setne byte [ebp - 0xd]
add ecx, 0xfffffff0
call fcn.0042101a
cmp byte [ebp - 0xd], bl
je 0x428995
push edi
mov ecx, esi
call fcn.00427b99
mov esi, dword [0x4ea798]
call fcn.004648b0
push dword [0x4ea798]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4289e2
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Diff_Init:_Cannot_create_TempDir
call fcn.00423442
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.General
mov byte [ebp - 4], 3
call fcn.00423442
push 3
mov byte [ebp - 4], bl
call fcn.004668c0
add esp, 0xc
push 0x4ea7c0
call fcn.00428a3b
mov esi, 0x4c4fbc
push esi
mov ecx, 0x4ea79c
call fcn.00423efa
push esi
mov ecx, 0x4ea7a4
call fcn.00423efa
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00423442
push 0x4ea7d8
call fcn.00428adb
call fcn.0044a0d0
call fcn.0043f0c0
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042101a
xor eax, eax
inc eax
call fcn.004a28cb
ret
Function at 0x429cb8
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
xor eax, eax
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x14], ecx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x34], ecx
xor eax, eax
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x24]
push ecx
push eax
call ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call ebx
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x10]
sub esi, dword [ebp - 0xc]
sub edi, dword [ebp - 8]
sub esi, dword [ebp - 0x24]
sub edi, dword [ebp - 0x20]
add esi, dword [ebp - 0x14]
add edi, dword [ebp - 0x18]
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x429d4e
lea ecx, [ebp - 0x34]
push ecx
push eax
call ebx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
test eax, eax
jg 0x429d40
test ecx, ecx
jle 0x429d4e
jmp 0x429d45
sub eax, dword [ebp - 0x28]
add edi, eax
test ecx, ecx
jle 0x429d4e
sub ecx, dword [ebp - 0x2c]
add esi, ecx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 1
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MoveWindow]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x429eab
Capabilities:
Create directory
Create thread

Disassembly:
push 0x30
mov eax, 0x4b8ba7
call fcn.004a27f3
xor esi, esi
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
mov ebx, 0x4c33f0
push ebx
mov dword [ebp - 0x18], esi
call fcn.00423442
lea eax, [ebp - 0x10]
push eax
call fcn.00461460
pop ecx
pop ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0042101a
push 0x10
call fcn.0048ee50
mov edi, eax
pop ecx
cmp edi, esi
je 0x429f12
lea ecx, [edi + 8]
call fcn.0042148a
lea ecx, [edi + 0xc]
call fcn.0042148a
mov dword [0x4ea728], edi
jmp 0x429f18
mov dword [0x4ea728], esi
push ecx
mov edi, esp
mov dword [ebp - 0x14], esp
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x4c2ec8
call fcn.00423442
push ecx
mov dword [ebp - 4], esi
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.Troubleshoot.log
call fcn.00423442
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push ecx
mov dword [ebp - 0x14], esp
mov ecx, esp
push ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], eax
call fcn.00423442
mov eax, dword [ebp - 0x14]
push eax
call fcn.00461460
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
call fcn.004618b0
add esp, 0xc
call fcn.004298cf
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp + 8]
push 0x429bd8
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x429fa7
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push esi
push esi
push esi
lea eax, [ebp - 0x3c]
push eax
call edi
test eax, eax
jg 0x429f93
mov eax, dword [ebp - 0x34]
call fcn.004a28cb
ret 4
Function at 0x42a72e
Capabilities:
Move file

Disassembly:
push 0x18
mov eax, 0x4b7d33
call fcn.004a27f3
mov esi, ecx
and dword [ebp - 4], 0
push 0
call fcn.0049ea9c
push eax
call fcn.0049ea68
pop ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x4c2ec8
call fcn.00423442
mov byte [ebp - 4], 1
call fcn.0049ea7a
push ecx
mov edi, esp
mov dword [ebp - 0x20], esp
push eax
push 0x5c
push ecx
lea eax, [ebp + 8]
mov dword [ebp - 0x24], esp
mov ecx, esp
push eax
call fcn.00423ad0
lea eax, [ebp - 0x18]
push eax
call fcn.00462270
add esp, 0xc
mov byte [ebp - 4], 2
push dword [eax]
push str._s._d.ToDelete
push edi
call fcn.00461d60
add esp, 0xc
lea eax, [esi + 0x40]
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
mov byte [ebp - 4], 3
call fcn.0042342d
lea edi, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.004618b0
add esp, 0xc
mov byte [ebp - 4], 5
push dword [eax]
lea eax, [ebp + 8]
push ecx
mov dword [ebp - 0x24], esp
mov ecx, esp
push eax
call fcn.00423ad0
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.0047aaf0
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.0042101a
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, esi
call fcn.004a28cb
ret
Function at 0x42a81f
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push 0x274
mov eax, 0x4b7ce3
call fcn.004a285c
xor edi, edi
push 0x24c
lea eax, [ebp - 0x260]
push edi
push eax
mov ebx, ecx
mov dword [ebp - 0x264], edi
call fcn.0049e2e0
add esp, 0xc
lea eax, [ebp - 0x264]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x270], esp
mov esi, 0x4c2ec8
push esi
call fcn.00423442
push ecx
mov dword [ebp - 4], edi
mov ecx, esp
mov dword [ebp - 0x280], esp
push str..ToDelete
call fcn.00423442
push ecx
mov byte [ebp - 4], 1
add ebx, 0x40
mov ecx, esp
mov dword [ebp - 0x27c], esp
push ebx
call fcn.0042342d
or dword [ebp - 4], 0xffffffff
lea edi, [ebp - 0x274]
call fcn.004618b0
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x274]
cmp eax, 0xffffffff
setne byte [ebp - 0x265]
add ecx, 0xfffffff0
mov dword [ebp - 0x270], eax
call fcn.0042101a
cmp byte [ebp - 0x265], 0
je 0x42a997
push ecx
mov ecx, esp
mov dword [ebp - 0x27c], esp
push esi
call fcn.00423442
push ecx
mov dword [ebp - 4], 2
lea eax, [ebp - 0x238]
mov ecx, esp
mov dword [ebp - 0x280], esp
push eax
call fcn.00423442
push ecx
mov ecx, esp
mov dword [ebp - 0x278], esp
push ebx
mov byte [ebp - 4], 3
call fcn.0042342d
or dword [ebp - 4], 0xffffffff
lea edi, [ebp - 0x26c]
call fcn.004618b0
add esp, 8
mov eax, esp
mov dword [ebp - 0x278], esp
mov dword [ebp - 4], 4
push dword [ebp - 0x26c]
push str.DeleteSharingViolationRemains:_deleting__s
push eax
call fcn.00461d60
add esp, 0xc
call fcn.0042a2c5
pop ecx
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x26c]
add ecx, 0xfffffff0
call fcn.0042101a
lea eax, [ebp - 0x264]
push eax
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x42a8d9
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_FindClose]
call fcn.004a28df
ret
Function at 0x42be24
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push 0x1c
mov eax, 0x4b7c91
call fcn.004a27f3
push ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, esp
mov dword [ebp - 0x24], esp
push dword [ebp + 8]
push str.Loader_SetVirtEnvVariables:_in___s_
push eax
call fcn.00461d60
add esp, 0xc
call fcn.0042a2c5
pop ecx
mov dword [ebp - 0x1c], ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.::
lea edi, [ebp - 0x1c]
call fcn.00423442
push ecx
lea eax, [ebp + 8]
mov dword [ebp - 0x28], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 1
call fcn.00423ad0
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], bl
call fcn.00465cf0
add esp, 8
mov eax, esp
mov dword [ebp - 0x28], esp
mov byte [ebp - 4], 2
push dword [ebp - 0x10]
push str.Loader_SetVirtEnvVariables:_setting_Env_variable:__s
push eax
call fcn.00461d60
add esp, 0xc
call fcn.0042a2c5
pop ecx
push ebx
push 0x3d
lea ecx, [ebp - 0x10]
call fcn.004257fd
mov esi, eax
cmp esi, 0xffffffff
jne 0x42beda
push ecx
mov eax, esp
mov dword [ebp - 0x28], esp
push str.Loader_SetVirtEnvVariables:__error:_Env_variable_doesnt_contain_
push eax
call fcn.00461d60
pop ecx
pop ecx
call fcn.0042a2c5
pop ecx
jmp 0x42bfc7
push esi
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x10]
call fcn.00423631
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00423ad0
push ebx
lea ecx, [ebp - 0x14]
lea eax, [esi + 1]
push ecx
mov byte [ebp - 4], 4
call fcn.004234d9
push str._ExistingValue_
xor ecx, ecx
lea esi, [ebp - 0x14]
call fcn.00423555
mov esi, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x42bfac
call fcn.0048f565
push eax
lea ecx, [ebp - 0x18]
call fcn.0042149e
push ebx
push ebx
mov byte [ebp - 4], 5
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push esi
call edi
mov dword [ebp - 0x24], eax
cmp eax, ebx
je 0x42bf74
push eax
lea ecx, [ebp - 0x18]
call fcn.004214d0
push dword [ebp - 0x24]
push eax
push esi
call edi
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
mov edi, eax
call fcn.00423750
cmp edi, ebx
jne 0x42bf74
push 0x4c4fbc
lea ecx, [ebp - 0x18]
call fcn.00423efa
mov edi, dword [ebp - 0x18]
push edi
push str._ExistingValue_
lea eax, [ebp - 0x14]
push eax
call fcn.00430457
push ecx
mov eax, esp
mov dword [ebp - 0x28], esp
lea ecx, [ebp - 0x14]
push ecx
push str.Loader_SetVirtEnvVariables:_replacing__ExistingValue__with_existing_value:
push eax
call fcn.004236e6
add esp, 0xc
call fcn.0042a2c5
pop ecx
lea ecx, [edi - 0x10]
call fcn.0042101a
mov edi, dword [ebp - 0x14]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea ecx, [edi - 0x10]
call fcn.0042101a
lea ecx, [esi - 0x10]
call fcn.0042101a
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x42be55
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042101a
call fcn.004a28cb
ret
Function at 0x42c0b7
Capabilities:
Set environment variable

Disassembly:
push 0x10
mov eax, 0x4b7c46
call fcn.004a27f3
xor ebx, ebx
push ebx
push ecx
mov dword [ebp - 4], ebx
lea eax, [esi + 0x40]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.0042342d
push ecx
mov byte [ebp - 4], 1
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.BaseDirName
call fcn.00423442
push ecx
mov byte [ebp - 4], 2
mov eax, esp
mov dword [ebp - 0x18], esp
push dword [esi + 8]
mov edi, str.SoftwareVOS_s
push edi
push eax
call fcn.00461d60
add esp, 0xc
mov byte [ebp - 4], 3
call fcn.00471bd0
push eax
mov byte [ebp - 4], bl
call fcn.00463040
add esp, 0x14
and eax, 1
push ebx
push ecx
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
call fcn.00423ad0
push ecx
mov byte [ebp - 4], 4
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.CarrierExeName
call fcn.00423442
push ecx
mov byte [ebp - 4], 5
mov eax, esp
mov dword [ebp - 0x1c], esp
push dword [esi + 8]
push edi
push eax
call fcn.00461d60
add esp, 0xc
mov byte [ebp - 4], 6
call fcn.00471bd0
push eax
mov byte [ebp - 4], bl
call fcn.00463040
mov edi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add esp, 0x14
push dword [esi + 8]
mov ebx, eax
push str.CAMEYO_RO_APPID
call edi
push dword [esi + 0x44]
push str.CAMEYO_RO_CARRIEREXE
call edi
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, ebx
and eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
inc eax
call fcn.004a28cb
ret
Function at 0x42f981
Capabilities:
Delete directory
Query or enumerate registry value

Disassembly:
push 0x20
mov eax, 0x4b7931
call fcn.004a27f3
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
call fcn.0048f565
push eax
lea ecx, [ebp - 0x10]
call fcn.0042149e
push ecx
mov dword [ebp - 4], ebx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.Loader_UnregisterApp_Shortcuts_NewDirs
mov dword [ebp - 0x24], 1
call fcn.00423442
call fcn.0042a2c5
push dword [0x4ea9b0]
mov edi, str.SoftwareVOS_s
lea eax, [ebp - 0x18]
push edi
push eax
call fcn.00461d60
mov esi, str.IntegratedLnkNewDirs
push esi
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 1
call fcn.00423691
add esp, 0x1c
lea ecx, [ebp - 0x1c]
push ecx
push 9
mov byte [ebp - 4], 2
mov eax, dword [eax]
push ebx
push eax
call fcn.00471bd0
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
mov dword [ebp - 0x14], eax
call fcn.0042101a
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [ebp - 0x14], ebx
je 0x42fa39
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, ebx
call fcn.004a28cb
ret
mov dword [ebp - 0x18], ebx
mov eax, 0x514
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x28], eax
call fcn.004214d0
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x28]
push ecx
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
call fcn.00423750
cmp dword [ebp - 0x14], ebx
je 0x42fa77
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [ebp - 0x20], 0x4c8230
cmp eax, ebx
jne 0x42fa92
mov dword [ebp - 0x20], str.ERROR
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x10]
push str.Loader_UnregisterApp_Shortcuts_NewDirs:_dir_to_remove:__s____s__LE_d_
push ecx
call fcn.00461d60
add esp, 0x14
call fcn.0042a2c5
inc dword [ebp - 0x18]
pop ecx
cmp dword [ebp - 0x14], ebx
je 0x42fa3c
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [0x4ea9b0]
lea eax, [ebp - 0x20]
push edi
push eax
call fcn.00461d60
push esi
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 3
call fcn.00423691
add esp, 0x18
mov byte [ebp - 4], 4
push dword [eax]
call fcn.00471bd0
push eax
call fcn.004632d0
pop ecx
pop ecx
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0042101a
mov ebx, dword [ebp - 0x24]
jmp 0x42fa26
Function at 0x42fb21
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x4b8b39
call fcn.004a27f3
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
call fcn.0048f565
push eax
lea ecx, [ebp - 0x10]
call fcn.0042149e
mov dword [ebp - 4], ebx
push dword [0x4ea9b0]
mov edi, str.SoftwareVOS_s
lea eax, [ebp - 0x20]
push edi
push eax
call fcn.00461d60
mov esi, str.IntegratedLnk
push esi
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.00423691
add esp, 0x18
lea ecx, [ebp - 0x1c]
push ecx
push 9
mov byte [ebp - 4], 2
mov eax, dword [eax]
push ebx
push eax
call fcn.00471bd0
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov dword [ebp - 0x14], eax
call fcn.0042101a
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0042101a
cmp dword [ebp - 0x14], ebx
je 0x42fbbd
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0042101a
mov eax, ebx
call fcn.004a28cb
ret
mov dword [ebp - 0x18], ebx
mov eax, 0x514
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x20], eax
call fcn.004214d0
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x20]
push ecx
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
call fcn.00423750
cmp dword [ebp - 0x14], ebx
jne 0x42fc4e
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.00423ad0
call fcn.00465470
pop ecx
mov dword [ebp - 0x14], 0x4c8230
cmp eax, ebx
jne 0x42fc1f
mov dword [ebp - 0x14], str.ERROR
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push str.Loader_UnregisterApp_Shortcuts:_Lnk_to_remove:__s____s__LE_d_
push ecx
call fcn.00461d60
add esp, 0x14
call fcn.0042a2c5
inc dword [ebp - 0x18]
pop ecx
jmp 0x42fbc0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0042f981
push dword [0x4ea9b0]
lea eax, [ebp - 0x18]
push edi
push eax
call fcn.00461d60
push esi
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 3
call fcn.00423691
add esp, 0x18
mov byte [ebp - 4], 4
push dword [eax]
call fcn.00471bd0
push eax
call fcn.004632d0
pop ecx
pop ecx
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0042101a
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0042101a
xor ebx, ebx
inc ebx
jmp 0x42fbaa