joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42744c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffbd0
mov esi, edx
mov edi, eax
xor ebx, ebx
test esi, esi
jne 0x427516
xor esi, esi
push 0x20a
lea eax, [esp + 8]
push eax
push esi
push edi
call sub.advapi32.dll_RegEnumKeyW
mov ebx, eax
test ebx, ebx
je 0x427490
cmp ebx, 0x103
jne 0x4275b6
xor ebx, ebx
jmp 0x4275b6
cmp word [esp + 4], 0x2e
jne 0x4274fc
mov dword [esp], 0x20a
push esp
lea eax, [esp + 0x212]
push eax
lea eax, [esp + 0xc]
push eax
push edi
call sub.advapi32.dll_RegQueryValueW
mov ebx, eax
test ebx, ebx
jne 0x4275b6
lea eax, [esp + 4]
mov dword [esp + 0x418], eax
mov byte [esp + 0x41c], 0xa
lea eax, [esp + 0x20e]
mov dword [esp + 0x420], eax
mov byte [esp + 0x424], 0xa
lea edx, [esp + 0x418]
mov eax, 0x4275c8
mov ecx, 1
call fcn.0041e438
mov eax, dword [0x435b90]
cmp dword [eax], 0
je 0x427510
mov ebp, 1
jmp 0x4275b8
inc esi
jmp 0x427466
xor edx, edx
mov eax, esi
call fcn.0042f470
mov esi, eax
mov dx, 0x20
mov eax, esi
call fcn.00419f9c
test eax, eax
je 0x427535
mov word [eax], 0
mov dword [esp], 0x20a
push esp
lea eax, [esp + 0x212]
push eax
push esi
push edi
call sub.advapi32.dll_RegQueryValueW
mov ebx, eax
test ebx, ebx
jne 0x42758f
mov dword [esp + 0x418], esi
mov byte [esp + 0x41c], 0xa
lea eax, [esp + 0x20e]
mov dword [esp + 0x420], eax
mov byte [esp + 0x424], 0xa
lea edx, [esp + 0x418]
mov eax, 0x4275c8
mov ecx, 1
call fcn.0041e438
jmp 0x4275b6
push 0
mov dword [esp + 0x42c], esi
mov byte [esp + 0x430], 0xa
lea ecx, [esp + 0x42c]
mov edx, 1
mov eax, 0x4275e4
call fcn.0042ed3c
mov ebp, ebx
mov eax, ebp
add esp, 0x430
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x427640
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe8
mov ebx, ecx
mov edi, edx
mov esi, eax
test ebx, ebx
je 0x427656
cmp word [ebx], 0
jne 0x427683
push edi
push esi
call sub.advapi32.dll_RegDeleteKeyW
mov esi, eax
test esi, esi
je 0x4276e0
push 0
mov dword [esp + 4], edi
mov byte [esp + 8], 0xa
lea ecx, [esp + 4]
mov edx, 1
mov eax, 0x4276f8
call fcn.0042ed3c
jmp 0x4276e0
mov eax, ebx
call fcn.00419fe4
push eax
push ebx
push 1
push edi
push esi
call sub.advapi32.dll_RegSetValueW
mov esi, eax
test esi, esi
jne 0x4276c2
mov dword [esp + 8], edi
mov byte [esp + 0xc], 0xa
mov dword [esp + 0x10], ebx
mov byte [esp + 0x14], 0xa
lea edx, [esp + 8]
mov eax, 0x427754
mov ecx, 1
call fcn.0041e438
jmp 0x4276e0
push 0
mov dword [esp + 4], edi
mov byte [esp + 8], 0xa
lea ecx, [esp + 4]
mov edx, 1
mov eax, 0x427770
call fcn.0042ed3c
mov eax, esi
add esp, 0x18
pop edi
pop esi
pop ebx
ret
Function at 0x4279bc
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffbc4
mov esi, edx
mov edi, eax
xor ebx, ebx
test esi, esi
jne 0x427af8
xor esi, esi
push 0x20a
lea eax, [esp + 0x14]
push eax
push esi
push edi
call sub.advapi32.dll_RegEnumKeyW
mov ebx, eax
test ebx, ebx
je 0x427a00
cmp ebx, 0x103
jne 0x427c59
xor ebx, ebx
jmp 0x427c59
cmp word [esp + 0x10], 0x2e
je 0x427ade
lea eax, [esp + 0x10]
call fcn.00419fe4
mov dword [esp + 8], eax
mov edx, 0x427c68
lea eax, [esp + 0x10]
call fcn.0041a008
mov edx, 0x427c90
lea eax, [esp + 0x21a]
call fcn.00419ff4
push esp
lea eax, [esp + 0x14]
push eax
push edi
call sub.advapi32.dll_RegOpenKeyW
mov ebx, eax
test ebx, ebx
jne 0x427a8b
mov eax, dword [esp + 8]
mov word [esp + eax*2 + 0x10], 0
mov dword [esp + 4], 0x20a
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x21e]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0x427cd0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov ebx, eax
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
jne 0x427ade
mov eax, dword [esp + 4]
shr eax, 1
mov word [esp + eax*2 + 0x218], 0
lea eax, [esp + 0x10]
mov dword [esp + 0x424], eax
mov byte [esp + 0x428], 0xa
lea eax, [esp + 0x21a]
mov dword [esp + 0x42c], eax
mov byte [esp + 0x430], 0xa
lea edx, [esp + 0x424]
mov eax, 0x427cd4
mov ecx, 1
call fcn.0041e438
mov eax, dword [0x435b90]
cmp dword [eax], 0
je 0x427af2
mov ebp, 1
jmp 0x427c5b
inc esi
jmp 0x4279d6
cmp word [esi], 0x2e
jne 0x427b2f
push 0
mov dword [esp + 0x438], esi
mov byte [esp + 0x43c], 0xa
lea ecx, [esp + 0x438]
mov edx, 1
mov eax, 0x427cf0
call fcn.0042ed3c
mov ebp, 0x7b
jmp 0x427c5b
xor edx, edx
mov eax, esi
call fcn.0042f470
mov esi, eax
mov dx, 0x20
mov eax, esi
call fcn.00419f9c
test eax, eax
je 0x427b4e
mov word [eax], 0
push 0
mov dword [esp + 0x438], esi
mov byte [esp + 0x43c], 0xa
lea ecx, [esp + 0x438]
mov edx, 0x427d74
lea eax, [esp + 0x14]
call fcn.0041a0a0
push esp
lea eax, [esp + 0x14]
push eax
push edi
call sub.advapi32.dll_RegOpenKeyW
mov ebx, eax
test ebx, ebx
je 0x427bb4
push 0
mov dword [esp + 0x438], esi
mov byte [esp + 0x43c], 0xa
lea ecx, [esp + 0x438]
mov edx, 1
mov eax, 0x427cf0
call fcn.0042ed3c
mov ebp, ebx
jmp 0x427c5b
mov dword [esp + 4], 0x20a
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x21e]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0x427cd0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov ebx, eax
test ebx, ebx
jne 0x427c32
mov eax, dword [esp + 4]
shr eax, 1
mov word [esp + eax*2 + 0x218], 0
mov dword [esp + 0x424], esi
mov byte [esp + 0x428], 0xa
lea eax, [esp + 0x21a]
mov dword [esp + 0x42c], eax
mov byte [esp + 0x430], 0xa
lea edx, [esp + 0x424]
mov eax, 0x427cd4
mov ecx, 1
call fcn.0041e438
jmp 0x427c59
push 0
mov dword [esp + 0x438], esi
mov byte [esp + 0x43c], 0xa
lea ecx, [esp + 0x438]
mov edx, 1
mov eax, 0x427cf0
call fcn.0042ed3c
mov ebp, ebx
mov eax, ebp
add esp, 0x43c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x427da0
Capabilities:
Delete registry key
Persist via default file association registry key
Set registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdc4
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
push 0
mov eax, dword [esp + 8]
mov dword [esp + 0x228], eax
mov byte [esp + 0x22c], 0xa
lea ecx, [esp + 0x228]
mov edx, 0x427fe4
lea eax, [esp + 0x1c]
call fcn.0041a0a0
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 8]
push eax
call sub.advapi32.dll_RegOpenKeyW
mov edi, eax
test edi, edi
je 0x427edb
cmp dword [esp + 8], 0
je 0x427e0e
mov eax, dword [esp + 8]
cmp word [eax], 0
jne 0x427e42
push 0
mov eax, dword [esp + 8]
mov dword [esp + 0x228], eax
mov byte [esp + 0x22c], 0xa
lea ecx, [esp + 0x228]
mov edx, 1
mov eax, 0x42801c
call fcn.0042ed3c
mov dword [esp + 0xc], edi
jmp 0x427fd4
lea ebx, [esp + 0x18]
jmp 0x427e4b
add ebx, 2
movzx esi, word [ebx]
test si, si
je 0x427e59
cmp si, 0x5c
jne 0x427e48
movzx ebp, word [ebx]
mov word [ebx], 0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0x2000000
push 0
push 0
push 0
lea eax, [esp + 0x34]
push eax
mov eax, dword [esp + 0x20]
push eax
call sub.advapi32.dll_RegCreateKeyExW
mov edi, eax
test edi, edi
je 0x427ec1
push 0
mov eax, dword [esp + 8]
mov dword [esp + 0x228], eax
mov byte [esp + 0x22c], 0xa
lea ecx, [esp + 0x228]
mov edx, 1
mov eax, 0x42801c
call fcn.0042ed3c
mov dword [esp + 0xc], edi
jmp 0x427fd4
test bp, bp
je 0x427edb
mov word [ebx], bp
add ebx, 2
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x427e4b
cmp dword [esp + 8], 0
je 0x427eec
mov eax, dword [esp + 8]
cmp word [eax], 0
jne 0x427f32
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov edi, eax
test edi, edi
je 0x427fc6
push 0
mov eax, dword [esp + 8]
mov dword [esp + 0x228], eax
mov byte [esp + 0x22c], 0xa
lea ecx, [esp + 0x228]
mov edx, 1
mov eax, 0x42801c
call fcn.0042ed3c
jmp 0x427fc6
mov eax, dword [esp + 8]
call fcn.00419fe4
inc eax
add eax, eax
push eax
mov eax, dword [esp + 0xc]
push eax
push 2
push 0
push 0x4280a0
mov eax, dword [esp + 0x24]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edi, eax
test edi, edi
jne 0x427f9b
mov eax, dword [esp + 4]
mov dword [esp + 0x22c], eax
mov byte [esp + 0x230], 0xa
mov eax, dword [esp + 8]
mov dword [esp + 0x234], eax
mov byte [esp + 0x238], 0xa
lea edx, [esp + 0x22c]
mov eax, 0x4280a4
mov ecx, 1
call fcn.0041e438
jmp 0x427fc6
push 0
mov eax, dword [esp + 8]
mov dword [esp + 0x228], eax
mov byte [esp + 0x22c], 0xa
lea ecx, [esp + 0x228]
mov edx, 1
mov eax, 0x4280c0
call fcn.0042ed3c
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov dword [esp + 0xc], edi
mov eax, dword [esp + 0xc]
add esp, 0x23c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4283d0
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
add esp, 0xfffffec8
xor esi, esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call sub.kernel32.dll_CreateFileW_1
mov ebx, eax
test ebx, ebx
je 0x42846b
lea edx, [esp + 4]
mov ecx, 0x40
mov eax, ebx
call fcn.00414918
cmp word [esp + 4], 0x5a4d
jne 0x428465
xor ecx, ecx
mov edx, dword [esp + 0x40]
mov eax, ebx
call fcn.00414944
mov edx, esp
mov ecx, 4
mov eax, ebx
call fcn.00414918
cmp dword [esp], 0x4550
jne 0x428465
lea edx, [esp + 0x44]
mov ecx, 0x14
mov eax, ebx
call fcn.00414918
cmp word [esp + 0x54], 0
jbe 0x428465
lea edx, [esp + 0x58]
mov ecx, 0xe0
mov eax, ebx
call fcn.00414918
movzx esi, word [esp + 0x9c]
push ebx
call sub.kernel32.dll_CloseHandle_1
mov eax, esi
add esp, 0x138
pop esi
pop ebx
ret

Function at 0x4285f4
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp], edx
mov edi, eax
mov ebp, dword [0x435ac8]
mov eax, edi
call fcn.004285d4
inc eax
jne 0x428708
mov eax, edi
call fcn.00406da0
mov dword [esp + 4], eax
mov eax, dword [ebp]
call fcn.00407ad4
mov ebx, eax
lea eax, [ebx + 1]
push eax
mov eax, ebp
mov ecx, 1
mov edx, dword [0x419da8]
call fcn.00407cf0
add esp, 4
mov eax, dword [esp + 4]
lea eax, [eax + eax*2]
call fcn.00403f2c
lea esi, [ebx + ebx*2]
mov edx, dword [ebp]
mov dword [edx + esi*8], eax
lea eax, [ebx + ebx*2]
mov edx, dword [ebp]
mov eax, dword [edx + eax*8]
mov edx, edi
call fcn.00414b50
mov eax, dword [ebp]
mov edx, dword [esp]
mov dword [eax + esi*8 + 4], edx
mov eax, dword [esp]
push eax
call sub.msvcrt.dll__get_osfhandle
pop ecx
mov edx, dword [ebp]
mov dword [edx + esi*8 + 8], eax
push 2
push 0
push 0
lea eax, [ebx + ebx*2]
mov edx, dword [ebp]
mov eax, dword [edx + eax*8 + 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
mov edx, dword [ebp]
mov dword [edx + esi*8 + 0xc], eax
lea eax, [ebx + ebx*2]
mov edx, dword [ebp]
mov eax, dword [edx + eax*8 + 0xc]
call fcn.00403f2c
mov edx, dword [ebp]
mov dword [edx + esi*8 + 0x10], eax
push 0
push 0
push 0
mov eax, dword [ebp]
mov eax, dword [eax + esi*8 + 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [ebp]
mov eax, dword [eax + esi*8 + 0xc]
push eax
mov eax, dword [ebp]
mov eax, dword [eax + esi*8 + 0x10]
push eax
mov eax, dword [ebp]
mov eax, dword [eax + esi*8 + 8]
push eax
call sub.kernel32.dll_ReadFile_1
mov eax, dword [ebp]
mov edx, dword [eax + esi*8 + 0xc]
mov eax, dword [ebp]
mov eax, dword [eax + esi*8 + 0x10]
call fcn.0041a2bc
mov eax, dword [ebp]
xor edx, edx
mov dword [eax + esi*8 + 0x14], edx
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42a470
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00419fe4
mov edi, eax
xor eax, eax
mov ebx, dword [ebp + 8]
jmp 0x42a4a2
inc eax
jmp 0x42a49c
add ebx, 2
cmp word [ebx], 0
jne 0x42a499
cmp word [ebx], 0
jne 0x42a496
sub ebx, dword [ebp + 8]
sar ebx, 1
jns 0x42a4b2
adc ebx, 0
inc ebx
add ebx, edi
mov edx, ebx
add edx, edx
imul edx, eax
mov eax, edx
call fcn.0042dba0
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp + 8]
mov esi, dword [ebp - 0x10]
jmp 0x42a4fe
mov ecx, edi
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00419f18
mov eax, edi
add eax, eax
add eax, esi
mov edx, ebx
call fcn.00419ff4
mov eax, edi
add eax, eax
add esi, eax
jmp 0x42a4f5
add ebx, 2
add esi, 2
cmp word [ebx], 0
jne 0x42a4ef
add esi, 2
cmp word [ebx], 0
jne 0x42a4ce
mov word [esi], 0
mov eax, dword [ebp - 0x10]
push eax
push 1
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0042b25c
mov ebx, eax
mov eax, dword [ebp - 8]
mov word [eax], 0x2a
mov eax, dword [ebp - 8]
mov word [eax + 2], 0
lea eax, [ebp - 0x260]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov esi, eax
mov eax, dword [ebp - 8]
mov word [eax], 0
cmp esi, 0xffffffff
je 0x42a5e2
lea edx, [ebp - 0x234]
mov eax, dword [ebp - 8]
call fcn.00419ff4
test byte [ebp - 0x260], 0x10
je 0x42a5c7
mov edx, 0x42a5f0
lea eax, [ebp - 0x234]
call fcn.00414be0
test eax, eax
je 0x42a5c7
mov edx, 0x42a5f4
lea eax, [ebp - 0x234]
call fcn.00414be0
test eax, eax
je 0x42a5c7
mov eax, dword [ebp - 8]
call fcn.0041a0e8
mov ebx, eax
add ebx, 2
mov word [ebx], 0x5c
add ebx, 2
mov word [ebx], 0
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0042a470
mov ebx, eax
lea eax, [ebp - 0x260]
push eax
push esi
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x42a553
push esi
call sub.kernel32.dll_FindClose_1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42c3a4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
push eax
call sub.msvcrt.dll__get_osfhandle
pop ecx
mov dword [ebp - 0x10], eax
mov ebx, dword [0x435a54]
push 1
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetFilePointer_1
mov dword [ebp - 0xc], eax
push 0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x435a54]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x42c3f9
xor eax, eax
jmp 0x42c49f
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x42c408
xor eax, eax
jmp 0x42c49f
mov edi, dword [ebp + 8]
mov edi, dword [edi]
mov esi, edi
test esi, esi
jbe 0x42c45f
cmp esi, 3
jb 0x42c459
cmp byte [ebx], 0xa
jne 0x42c425
lea eax, [ebx + 1]
cmp byte [eax], 0xd
je 0x42c432
cmp byte [ebx], 0xd
jne 0x42c459
lea eax, [ebx + 1]
cmp byte [eax], 0xa
jne 0x42c459
lea eax, [ebx + 2]
mov byte [eax], 0
mov eax, dword [0x435a54]
mov edi, ebx
sub edi, eax
add edi, 2
push 0
push 0
mov eax, dword [ebp - 0xc]
add eax, edi
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_SetFilePointer_1
jmp 0x42c45f
dec esi
inc ebx
test esi, esi
ja 0x42c413
mov eax, dword [0x435bc8]
mov eax, dword [eax]
call fcn.00428524
mov edx, dword [ebp - 8]
push edx
mov edx, dword [ebp - 4]
push edx
push edi
mov edx, dword [0x435a54]
push edx
test eax, eax
setne al
and eax, 0x7f
push eax
mov eax, dword [0x435bc8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_MultiByteToWideChar_1
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [eax], edx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42c704
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x42c974
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x44e948], 0x44e930
push 0x44e930
call sub.kernel32.dll_InitializeCriticalSection_1
call fcn.0042d848
push 0xffffffffffffffff
push 0x42c6d4
call sub.kernel32.dll_SetConsoleCtrlHandler
call fcn.0042fb68
call fcn.0041bc9c
call fcn.0042cc54
lea eax, [ebp - 0x20]
call fcn.00419eb0
push dword [ebp - 0x20]
push 0x42c990
lea eax, [ebp - 0x24]
mov edx, dword [0x435bc4]
mov edx, dword [edx]
call fcn.0040709c
push dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00407290
mov eax, dword [ebp - 0x1c]
call fcn.00407044
mov edx, eax
mov eax, dword [0x435b74]
call fcn.00419ff4
mov eax, dword [0x435b74]
call fcn.00419fe4
mov ecx, eax
mov edx, dword [0x435b74]
mov eax, dword [0x435b74]
call fcn.0041fdbc
mov eax, 0x44e6ec
xor edx, edx
call fcn.0041dd34
call fcn.0042d500
mov eax, dword [0x435b74]
call fcn.0042cf14
mov ebx, eax
cmp word [0x44e6ec], 0x5c
jne 0x42c82c
cmp word [0x44e6ee], 0x5c
jne 0x42c82c
cmp byte [0x435982], 0
jne 0x42c82c
push 0
mov dword [ebp - 0x2c], 0x44e6ec
mov byte [ebp - 0x28], 0xa
lea ecx, [ebp - 0x2c]
mov edx, 1
mov eax, 0x42c9a8
call fcn.0042ed3c
push 0x105
push 0x44e6ec
call sub.kernel32.dll_GetWindowsDirectoryW
mov eax, 0x44e6ec
mov dl, 1
call fcn.0041e158
call sub.kernel32.dll_GetConsoleOutputCP_1
mov dword [0x44e90c], eax
push 0x44e8f8
mov eax, dword [0x44e90c]
push eax
call sub.kernel32.dll_GetCPInfo
call fcn.0041a3b4
mov eax, 0x20c
call fcn.00403f2c
mov dword [0x44e928], eax
mov eax, 0x20c
call fcn.00403f2c
mov dword [0x44e92c], eax
cmp dword [0x44e928], 0
je 0x42c89b
cmp dword [0x44e92c], 0
je 0x42c89b
push 0x104
mov eax, dword [0x44e92c]
push eax
call sub.kernel32.dll_GetConsoleTitleW
mov edx, dword [0x44e92c]
mov eax, dword [0x44e928]
call fcn.00419ff4
cmp byte [0x435981], 0
jne 0x42c8f1
mov eax, 1
call fcn.0041dcd0
test eax, eax
je 0x42c8f1
cmp word [0x4359a0], 0
je 0x42c8db
lea eax, [ebp - 0x16]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_GetConsoleScreenBufferInfo
test eax, eax
je 0x42c8db
movzx eax, word [ebp - 0xe]
mov word [0x4359a0], ax
cmp word [0x4359a0], 0
je 0x42c8f1
movzx eax, word [0x4359a0]
call fcn.004236b0
test ebx, ebx
jne 0x42c93c
push 0xffffffffffffffff
lea ecx, [ebp - 0x2c]
xor edx, edx
mov eax, 0x42ca90
call fcn.0042ecc4
cmp byte [0x43599a], 0
je 0x42c922
push 0xffffffffffffffff
lea ecx, [ebp - 0x2c]
xor edx, edx
mov eax, 0x42cb50
call fcn.0042ecc4
jmp 0x42c93c
cmp byte [0x435998], 0
je 0x42c93c
push 0xffffffffffffffff
lea ecx, [ebp - 0x2c]
xor edx, edx
mov eax, 0x42cbc4
call fcn.0042ecc4
push 0x42cc14
push 0x42cc38
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00409f44
mov edx, dword [0x435c48]
mov dword [edx], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42c97b
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.004069e4
ret
Function at 0x42cc54
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa8
lea edi, [esp + 8]
mov dword [esp + 0xc], 0x80000002
mov dword [esp + 0x10], 0x80000001
cmp byte [0x43599a], 0
je 0x42cc7f
mov byte [0x435998], 1
mov ebp, 2
lea esi, [esp + 0xc]
push esp
push 0x42ce24
mov eax, dword [esi]
push eax
call sub.advapi32.dll_RegOpenKeyW
test eax, eax
jne 0x42ce0e
xor eax, eax
mov dword [edi], eax
lea ebx, [esp + 0x18]
mov dword [esp + 4], 0x40
lea eax, [esp + 4]
push eax
push ebx
push edi
push 0
push 0x42ce70
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x42ccf1
cmp dword [edi], 4
jne 0x42ccdc
cmp dword [ebx], 0
setne al
mov byte [0x435982], al
jmp 0x42ccf1
cmp dword [edi], 1
jne 0x42ccf1
push ebx
call sub.msvcrt.dll__wtol
pop ecx
dec eax
sete al
mov byte [0x435982], al
lea eax, [esp + 4]
push eax
push ebx
push edi
push 0
push 0x42ce90
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x42cd34
cmp dword [edi], 4
jne 0x42cd1f
cmp dword [ebx], 0
setne al
mov byte [0x435998], al
jmp 0x42cd34
cmp dword [edi], 1
jne 0x42cd34
push ebx
call sub.msvcrt.dll__wtol
pop ecx
dec eax
sete al
mov byte [0x435998], al
lea eax, [esp + 4]
push eax
push ebx
push edi
push 0
push 0x42ceb4
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x42cd77
cmp dword [edi], 4
jne 0x42cd62
cmp dword [ebx], 0
setne al
mov byte [0x435999], al
jmp 0x42cd77
cmp dword [edi], 1
jne 0x42cd77
push ebx
call sub.msvcrt.dll__wtol
pop ecx
dec eax
sete al
mov byte [0x435999], al
lea eax, [esp + 4]
push eax
push ebx
push edi
push 0
push 0x42ced8
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x42cdbe
cmp dword [edi], 4
jne 0x42cda3
movzx eax, word [ebx]
mov word [0x4359a0], ax
jmp 0x42cdbe
cmp dword [edi], 1
jne 0x42cdbe
push 0
lea eax, [esp + 0x18]
push eax
push ebx
call sub.msvcrt.dll_wcstol
add esp, 0xc
mov word [0x4359a0], ax
lea eax, [esp + 4]
push eax
push ebx
push edi
push 0
push 0x42cef4
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x42ce05
cmp dword [edi], 4
jne 0x42cdea
movzx eax, word [ebx]
mov word [0x4359a2], ax
jmp 0x42ce05
cmp dword [edi], 1
jne 0x42ce05
push 0
lea eax, [esp + 0x18]
push eax
push ebx
call sub.msvcrt.dll_wcstol
add esp, 0xc
mov word [0x4359a2], ax
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
add esi, 4
dec ebp
jne 0x42cc88
mov al, 1
add esp, 0x58
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42eb94
Capabilities:
Set current directory

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdec
xor edi, edi
mov word [esp], 0x3d
dec eax
add ax, 0x41
mov word [esp + 2], ax
mov word [esp + 4], 0x3a
mov word [esp + 6], 0
xor ebx, ebx
mov eax, esp
call fcn.0041bcc4
mov esi, eax
test esi, esi
je 0x42ebd8
push esi
call sub.kernel32.dll_SetCurrentDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x42ec43
test esi, esi
je 0x42ebe9
push 1
call sub.kernel32.dll_SetErrorMode
mov edi, eax
movzx eax, word [esp + 2]
mov word [esp + 8], ax
movzx eax, word [esp + 4]
mov word [esp + 0xa], ax
mov word [esp + 0xc], 0x5c
mov word [esp + 0xe], 0
lea edx, [esp + 8]
mov eax, esp
call fcn.0041bf74
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
test eax, eax
jne 0x42ec39
push 0xffffffffffffffff
lea ecx, [esp + 0x218]
xor edx, edx
mov eax, 0x42ec68
call fcn.0042ed3c
test esi, esi
je 0x42ec43
push edi
call sub.kernel32.dll_SetErrorMode
mov eax, dword [0x435ccc]
xor edx, edx
call fcn.0041dd34
add esp, 0x214
pop edi
pop esi
pop ebx
ret