joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4274a0
Capabilities:
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0042d730
add esp, 8
test eax, eax
jne 0x4274c3
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp - 0x2c]
push ebx
push esi
xor esi, esi
push edi
mov dword [eax], esi
call fcn.0042db50
mov ebx, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
test bl, 6
je 0x4274f4
push esi
push 1
push edi
lea ecx, [ebp - 0x2c]
call fcn.0042e890
test al, al
je 0x427691
test edi, edi
je 0x427691
cmp word [edi], si
je 0x427691
mov ecx, edi
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x427510
sub ecx, edx
sar ecx, 1
cmp word [edi + ecx*2 - 2], 0x2e
je 0x427691
test bl, 4
je 0x427541
mov edx, 0xc0000000
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], 2
jmp 0x42758d
test bl, 2
je 0x427571
mov eax, 0xc0000000
mov dword [ebp - 0xc], esi
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 3
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
and esi, 1
jne 0x427696
mov edx, 0xc0000000
jmp 0x427590
test bl, 1
je 0x427691
mov edx, SysReAllocString
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 3
mov dword [ebp - 0x10], edx
mov eax, ebx
and eax, 0x28
cmp al, 0x28
je 0x427691
mov ecx, ebx
mov eax, ebx
and ecx, 8
and eax, 0x20
add ecx, ecx
or ecx, eax
mov eax, 0x80
shl ecx, 0x17
test bl, 0x40
push 0
mov ebx, 0x4000100
cmovne eax, ebx
or ecx, eax
push ecx
push dword [ebp - 8]
mov dword [ebp - 0x14], ecx
push 0
push dword [ebp - 0xc]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x42764f
mov ebx, dword [ebp - 0x14]
test ebx, 0x10000000
je 0x42766d
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
cmp eax, 0xffffffff
jne 0x42760a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42766a
mov eax, dword [ebp - 0x14]
xor ecx, ecx
or ecx, dword [ebp - 0x18]
or eax, 0
mov dword [ebp - 0x18], eax
ja 0x427622
cmp ecx, 0xee6b280
jbe 0x42766a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
and ebx, 0xefffffff
push 0
push ebx
push dword [ebp - 8]
push 0
push dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x42766d
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.0042dd70
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp - 4]
test eax, eax
je 0x427696
push dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 8]
add eax, 8
push eax
call fcn.0042a080
add esp, 0xc
test al, al
jne 0x427696
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 1
lea ecx, [ebp - 0x2c]
call fcn.0042dd70
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x427780
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0042d730
add esp, 8
test eax, eax
je 0x42783b
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [eax + 8]
call fcn.0042a140
add esp, 0xc
test al, al
je 0x42782e
mov ebx, dword [ebp + 0x1c]
test ebx, ebx
je 0x42782e
mov esi, dword [ebp + 0x20]
test esi, esi
je 0x42782e
push dword [ebp + 0x18]
push 0
push 0x11
call dword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
mov dword [esi], eax
test eax, eax
je 0x42783b
push edi
lea ecx, [ebp - 4]
xor edi, edi
push ecx
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
test eax, eax
jne 0x427823
push eax
push ebx
push dword [ebp + 0x18]
mov dword [ebx], edi
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x427809
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push dword [esi]
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
test edi, edi
je 0x427823
push dword [esi]
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
mov dword [esi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
pop esi
mov eax, 0x57
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x427850
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0042d730
add esp, 8
test eax, eax
je 0x4278f7
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [eax + 8]
call fcn.0042a140
add esp, 0xc
test al, al
je 0x4278ea
mov ebx, dword [ebp + 0x1c]
test ebx, ebx
je 0x4278ea
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x4278ea
cmp word [esi], 1
jne 0x4278f7
cmp dword [esi + 4], 1
jne 0x4278f7
cmp dword [esi + 0x14], 0
jne 0x4278f7
push edi
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
mov edi, eax
test edi, edi
jne 0x4278e1
push eax
push ebx
mov dword [ebx], eax
push dword [esi + 0x10]
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4278d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
pop esi
mov eax, 0x57
pop ebx
mov esp, ebp
pop ebp
ret 0x18
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x427910
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0042d730
add esp, 8
test eax, eax
jne 0x427931
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret 0x18
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
push dword [edi + 8]
call fcn.0042a140
add esp, 0xc
test al, al
jne 0x427957
mov eax, 0x57
pop edi
mov esp, ebp
pop ebp
ret 0x18
push esi
push dword [ebp + 0x1c]
mov esi, dword [edi]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
mov esi, dword [esi + 0x60]
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [0x437430]
call esi
pop esi
test eax, eax
jne 0x42798a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb eax, eax
inc eax
pop edi
mov esp, ebp
pop ebp
ret 0x18

Function at 0x4279a0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push dword [ebp + 0x10]
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
call fcn.0042d730
add esp, 8
test eax, eax
jne 0x4279ca
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret 0x1c
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [eax + 8]
call fcn.0042a140
add esp, 0xc
test al, al
jne 0x4279ee
mov eax, 0x57
mov esp, ebp
pop ebp
ret 0x1c
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, eax
cmp edx, 0xffffffff
jne 0x427a0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esp, ebp
pop ebp
ret 0x1c
cmp dword [ebp + 0x20], 0
jne 0x427a29
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
xor eax, eax
mov esp, ebp
pop ebp
ret 0x1c
cmp dword [ebp - 4], 0
jne 0x427a44
cmp edx, 0x7fffffff
ja 0x427a44
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
xor eax, eax
mov esp, ebp
pop ebp
ret 0x1c
mov eax, 1
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x427a50
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0042d730
add esp, 8
test eax, eax
jne 0x427a73
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret 0x10
push esi
push edi
mov edi, dword [ebp + 0x14]
xor esi, esi
test edi, edi
je 0x427ace
lea ecx, [ebp - 0x10]
call fcn.0042db50
push esi
push 1
push edi
lea ecx, [ebp - 0x10]
call fcn.0042e890
test al, al
jne 0x427aa9
lea ecx, [ebp - 0x10]
call fcn.0042dd70
pop edi
lea eax, [esi + 1]
pop esi
mov esp, ebp
pop ebp
ret 0x10
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x427abc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [ebp - 0x10]
call fcn.0042dd70
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov esi, 1
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x427ae0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
push ebx
push edi
call fcn.0042d730
add esp, 8
test eax, eax
jne 0x427b09
pop edi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [ebp - 0x10]
call fcn.0042db50
push 0
push 1
push dword [ebp + 0x18]
lea ecx, [ebp - 0x10]
call fcn.0042e890
test al, al
je 0x427bcd
push 0
push 1
push dword [ebp + 0x1c]
lea ecx, [ebp - 0x10]
call fcn.0042e890
test al, al
je 0x427bcd
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
push esi
mov esi, dword [eax]
push dword [ecx]
push ebx
mov esi, dword [esi + 0x30]
mov ecx, esi
push edi
push eax
call dword [0x437430]
call esi
mov edi, eax
test edi, edi
jne 0x427bba
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wrename]
mov ecx, dword [ebp + 8]
add esp, 8
mov edi, eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ecx]
push dword [ebp + 0x14]
push 1
mov esi, dword [esi + 0x2c]
test edi, edi
jne 0x427baa
push dword [ebp + 0x1c]
push ebx
push eax
push ecx
mov ecx, esi
call dword [0x437430]
call esi
pop esi
lea ecx, [ebp - 0x10]
mov edi, eax
call fcn.0042dd70
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push dword [ebp + 0x18]
push ebx
push eax
push ecx
mov ecx, esi
call dword [0x437430]
call esi
pop esi
lea ecx, [ebp - 0x10]
call fcn.0042dd70
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [ebp - 0x10]
mov edi, 1
call fcn.0042dd70
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x18

Function at 0x427cb0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0042d730
add esp, 8
test eax, eax
jne 0x427cd3
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret 0x10
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
test esi, esi
je 0x427d7d
lea ecx, [ebp - 0x10]
call fcn.0042db50
push 1
push edi
push esi
lea ecx, [ebp - 0x10]
call fcn.0042e890
test al, al
jne 0x427d0d
lea ecx, [ebp - 0x10]
call fcn.0042dd70
lea eax, [edi + 1]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x427d12
sub ecx, edx
sar ecx, 1
je 0x427d66
movzx eax, word [esi + ecx*2 - 2]
cmp eax, 0x2e
je 0x427d66
cmp ecx, 1
jbe 0x427d3f
cmp word [esi + ecx*2 - 4], 0x2e
jne 0x427d3f
cmp eax, 0x5c
je 0x427d66
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x427d6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x10]
mov edi, eax
call fcn.0042dd70
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov edi, 1
lea ecx, [ebp - 0x10]
call fcn.0042dd70
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov edi, 1
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x427d90
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0042d730
add esp, 8
test eax, eax
jne 0x427db3
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret 0x10
push esi
push edi
mov edi, dword [ebp + 0x14]
xor esi, esi
test edi, edi
je 0x427e0d
lea ecx, [ebp - 0x10]
call fcn.0042db50
push esi
push esi
push edi
lea ecx, [ebp - 0x10]
call fcn.0042e890
test al, al
jne 0x427de8
lea ecx, [ebp - 0x10]
call fcn.0042dd70
pop edi
lea eax, [esi + 1]
pop esi
mov esp, ebp
pop ebp
ret 0x10
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x427dfb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [ebp - 0x10]
call fcn.0042dd70
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov esi, 1
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x428440
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [eax + 8]
call fcn.0042a180
add esp, 0xc
test al, al
jne 0x428468
mov eax, 0x57
mov esp, ebp
pop ebp
ret 0x10
push 4
lea eax, [ebp + 0x14]
push eax
push 4
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x428490
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push ebx
push esi
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [eax + 8]
call fcn.0042a180
add esp, 0xc
test al, al
je 0x42857c
mov ebx, dword [ebp + 0x18]
test ebx, ebx
je 0x42857c
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x42857c
cmp word [esi], 1
jne 0x42856f
cmp dword [esi + 4], 1
jne 0x42856f
cmp dword [esi + 0x14], 0
jne 0x42856f
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
test eax, eax
jne 0x428581
cmp ebx, 2
jb 0x42856f
test bl, 1
jne 0x42856f
cmp dword [esi + 0x10], ebx
jne 0x42856f
mov edx, dword [ebp - 4]
cmp byte [edx + ebx - 2], al
jne 0x42856f
cmp byte [edx + ebx - 1], al
jne 0x42856f
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x428520
sub ecx, edi
sar ecx, 1
pop edi
lea eax, [ecx*2 + 2]
cmp eax, ebx
jne 0x42856f
push ebx
push edx
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x42855e
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push esi
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x14
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, 0x57
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x428590
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [eax + 8]
call fcn.0042a180
add esp, 0xc
test al, al
jne 0x4285ba
mov eax, 0x57
mov esp, ebp
pop ebp
ret 0x10
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4285f5
cmp dword [ebp - 0xc], 4
jne 0x4285f5
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x10]
mov dword [ecx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10

Function at 0x428600
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push esi
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [eax + 8]
call fcn.0042a180
add esp, 0xc
test al, al
je 0x4286bc
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x4286bc
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4286b0
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x4286a7
push eax
push 0
push 0x11
call dword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
mov dword [esi], eax
test eax, eax
jne 0x428679
mov eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret 0x14
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
test eax, eax
jne 0x4286a7
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esi]
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x14
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x14
mov eax, 0x57
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x4286d0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [eax + 8]
call fcn.0042a180
add esp, 0xc
test al, al
jne 0x4286f8
mov eax, 0x57
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x428ac0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa48
mov eax, dword [0x441f9c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x14]
push eax
push ecx
call fcn.0042d730
add esp, 8
test eax, eax
je 0x428c4e
mov eax, dword [ebp + 0x20]
xorps xmm0, xmm0
mov dword [ebp - 0xa2c], eax
lea eax, [ebp - 0x208]
push eax
push 0
push 0
push 0
push esi
movlpd qword [ebp - 0xa28], xmm0
movlpd qword [ebp - 0xa20], xmm0
movlpd qword [ebp - 0xa18], xmm0
mov dword [ebp - 0xa10], 0
mov dword [ebp - 0xa48], 0x3c
mov dword [ebp - 0xa44], 0x100
mov dword [ebp - 0xa40], 0
mov dword [ebp - 0xa3c], edi
mov dword [ebp - 0xa38], esi
mov dword [ebp - 0xa34], 0
mov dword [ebp - 0xa30], ebx
mov dword [ebp - 0xa0c], 0x400
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath]
add esp, 0x14
lea eax, [ebp - 0xa0c]
push eax
lea eax, [ebp - 0xa08]
push eax
push str.open
lea eax, [ebp - 0x208]
push eax
push 9
push 0
call dword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
test eax, eax
jne 0x428c4e
push dword [ebp - 0xa0c]
lea eax, [ebp - 0xa08]
push str.WinWord
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
add esp, 0xc
test eax, eax
je 0x428c28
push dword [ebp - 0xa0c]
lea eax, [ebp - 0xa08]
push str.Excel
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
add esp, 0xc
test eax, eax
je 0x428c28
push dword [ebp - 0xa0c]
lea eax, [ebp - 0xa08]
push str.OUTLOOK
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
add esp, 0xc
test eax, eax
je 0x428c28
push dword [ebp - 0xa0c]
lea eax, [ebp - 0xa08]
push str.POWERPNT
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
add esp, 0xc
test eax, eax
jne 0x428c4e
lea eax, [ebp - 0xa48]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x428c4e
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004345b0
mov esp, ebp
pop ebp
ret 0x1c
mov ecx, dword [ebp - 4]
mov eax, 0x80004005
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004345b0
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x428c70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x441f9c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push eax
push ecx
call fcn.0042d730
add esp, 8
test eax, eax
jne 0x428cb1
mov eax, 0x80004005
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004345b0
mov esp, ebp
pop ebp
ret 0x10
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x428ce0
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor ecx, ecx
mov eax, ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004345b0
mov esp, ebp
pop ebp
ret 0x10
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
pop esi
sete cl
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004345b0
mov esp, ebp
pop ebp
ret 0x10
Function at 0x429e20
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x429f22
push esi
push 0x1fe
mov dword [ebp - 8], 0xff
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x429f18
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
push esi
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x429f0e
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x429f0e
push esi
push dword [ebp - 4]
call fcn.00429e20
add esp, 8
lea eax, [ebp - 0xc]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
push 0
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x429f0e
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
je 0x429f0e
lea eax, [ebp - 0x18]
mov dword [ebp - 8], 0xff
push eax
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
push esi
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x429e87
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esp, ebp
pop ebp
ret
Function at 0x42a340
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43613f
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x441f9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
cmp dword [ebp + 8], 0
mov dword [edi + 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x38], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x3c], eax
mov eax, dword [ebp + 0x20]
mov dword [edi + 0x40], eax
mov eax, dword [ebp + 0x24]
mov dword [edi + 0x44], eax
mov eax, dword [ebp + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [ebp + 0x2c]
mov dword [edi + 0x2c], eax
setne al
push str.MAPI32.DLL
mov byte [edi + 0x20], al
call fcn.0042d2b0
mov dword [edi + 0x18], eax
test eax, eax
je 0x42a494
push 0xc
call fcn.00434566
mov ebx, eax
add esp, 4
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x42a403
push str.MAPIFreeBuffer
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MAPIAllocateBuffer
push dword [edi + 0x18]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebx], vtable.MapiAllocator.0
mov dword [ebx + 4], eax
mov dword [ebx + 8], esi
jmp 0x42a405
xor ebx, ebx
push str.MAPIInitialize
push dword [edi + 0x18]
mov dword [ebp - 4], 0xffffffff
mov dword [edi + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MAPIUninitialize
push dword [edi + 0x18]
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MAPILogonEx
push dword [edi + 0x18]
mov dword [edi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HrQueryAllRows
push dword [edi + 0x18]
mov dword [edi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [edi + 4]
mov dword [edi + 0x10], eax
test esi, esi
je 0x42a494
cmp dword [edi + 8], 0
je 0x42a494
cmp dword [edi + 0xc], 0
je 0x42a494
push 0
mov ecx, esi
call dword [0x437430]
call esi
mov dword [edi + 0x1c], eax
test eax, eax
js 0x42a49b
mov esi, dword [edi + 0xc]
mov ecx, esi
push edi
push 0x63
push 0
push 0
push 0
call dword [0x437430]
call esi
mov dword [edi + 0x1c], eax
jmp 0x42a49b
mov dword [edi + 0x1c], 0x80040102
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x28