joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b760
Capabilities:
Get session user name
Get user security identifier

Disassembly:
sub esp, 0x18
push ebx
push ebp
xor ebx, ebx
push esi
push edi
cmp dword [esp + 0x2c], ebx
je 0x42b8d5
push 1
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], ebx
xor edi, edi
xor ebp, ebp
call fcn.0040ace0
add esp, 4
cmp eax, ebx
je 0x42b8d5
push eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x42b8d5
lea eax, [esp + 0x14]
push eax
push ebx
push 2
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x42b8c3
mov ecx, dword [esp + 0x14]
lea edx, [ecx + ecx]
push edx
call fcn.0044c68f
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x42b8c3
lea eax, [esp + 0x14]
push eax
push esi
push 2
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x42b8a0
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x1c]
push edx
push ebx
lea eax, [esp + 0x28]
push eax
push ebx
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x42b8a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x42b8a0
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0044c68f
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x42b8a0
mov edx, dword [esp + 0x18]
lea eax, [edx + edx]
push eax
call fcn.0044c68f
mov ebp, eax
add esp, 4
cmp ebp, ebx
je 0x42b8a0
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x1c]
push edx
push ebp
lea eax, [esp + 0x28]
push eax
push edi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x42b8a0
lea ecx, [esp + 0x10]
push ecx
push edi
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
je 0x42b8a0
mov edx, dword [esp + 0x10]
push edx
mov edx, dword [esp + 0x30]
lea ecx, [ebx + 0x64]
call fcn.00402eb0
mov edx, dword [esp + 0x10]
xor ecx, ecx
test eax, eax
setge cl
push edx
mov dword [esp + 0x24], ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esp + 0x10], ebx
push esi
call fcn.0044c4f7
add esp, 4
cmp edi, ebx
je 0x42b8b6
push edi
call fcn.0044c4f7
add esp, 4
cmp ebp, ebx
je 0x42b8c3
push ebp
call fcn.0044c4f7
add esp, 4
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x42be50
Capabilities:
Encode data using base64
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x47dd60
push 0x44eab0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4832f0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, ecx
mov esi, edx
mov ebx, dword [ebp + 8]
xor eax, eax
cmp esi, eax
je 0x42bfe6
cmp ebx, eax
je 0x42bfe6
cmp edi, eax
jbe 0x42bfe6
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x38], al
mov dword [ebp - 0x37], eax
mov dword [ebp - 0x33], eax
mov dword [ebp - 0x2f], eax
mov word [ebp - 0x2b], ax
mov byte [ebp - 0x29], al
mov byte [ebp - 0x28], al
mov dword [ebp - 0x27], eax
mov word [ebp - 0x23], ax
mov byte [ebp - 0x21], al
mov dword [ebp - 4], eax
lea eax, [ebp - 0x38]
push eax
push edi
push esi
call fcn.0042b8e0
add esp, 0xc
test eax, eax
je 0x42bfda
lea ecx, [ebp - 0x28]
push ecx
push edi
lea edi, [ebp - 0x38]
call fcn.0042bdc0
add esp, 8
test eax, eax
je 0x42bfda
xor esi, esi
mov dword [ebp - 0x44], esi
xor edx, edx
mov dword [ebp - 0x48], edx
mov al, byte [ebp + esi - 0x28]
mov byte [ebp - 0x3a], al
inc esi
mov dword [ebp - 0x44], esi
cmp esi, 8
jb 0x42bf19
xor cl, cl
jmp 0x42bf21
mov cl, byte [ebp + esi - 0x28]
inc esi
mov dword [ebp - 0x44], esi
cmp esi, 8
jb 0x42bf2c
mov byte [ebp - 0x39], 0
jmp 0x42bf37
mov al, byte [ebp + esi - 0x28]
mov byte [ebp - 0x39], al
inc esi
mov dword [ebp - 0x44], esi
movzx eax, byte [ebp - 0x3a]
mov edi, eax
shr edi, 2
mov di, word [edi*2 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ebx + edx*2], di
movzx ecx, cl
mov edi, ecx
shr edi, 4
and eax, 3
shl eax, 4
or edi, eax
movzx eax, word [edi*2 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ebx + edx*2 + 2], ax
movzx eax, byte [ebp - 0x39]
mov edi, eax
shr edi, 6
and ecx, 0xf
add ecx, ecx
add ecx, ecx
or edi, ecx
mov cx, word [edi*2 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ebx + edx*2 + 4], cx
and eax, 0x3f
movzx eax, word [eax*2 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [ebx + edx*2 + 6], ax
add edx, 4
mov dword [ebp - 0x48], edx
cmp esi, 8
jb 0x42bf05
mov ecx, 0x3d
mov word [ebx + edx*2 - 2], cx
xor eax, eax
mov word [ebx + edx*2], ax
mov dword [ebp - 0x40], 1
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x40]
jmp 0x42bfe8
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x40]
jmp 0x42bfe8
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.0044b6ee
mov esp, ebp
pop ebp
ret
Function at 0x42c010
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
push edi
xor esi, esi
push 0x206
lea ecx, [esp + 0x1a]
xor eax, eax
push esi
push ecx
xor ebx, ebx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
mov word [esp + 0x20], ax
call fcn.0044e9d0
add esp, 0xc
push 0x104
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edi, [esp + 0x14]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x42c064
mov ecx, 0xb
mov esi, str._system32Shell32.dll
lea eax, [esp + 0xc]
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.0042b520
add esp, 0xc
test eax, eax
je 0x42c0b0
cmp dword [esp + 0x10], 0x60002
jb 0x42c0b0
cmp dword [esp + 0xc], 0x295a01c8
mov eax, 1
jae 0x42c0b2
mov eax, ebx
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0044b6ee
add esp, 0x214
ret

Function at 0x42c940
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46a828
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x4832f0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
xor esi, esi
xor eax, eax
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], esi
mov word [esp + 0x18], ax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x44], esi
call fcn.0040a010
add esp, 4
lea edi, [esi + 8]
test eax, eax
je 0x42c9bd
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], edi
jae 0x42c9b2
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42c9d7
cmp dword [esp + 0x2c], edi
jb 0x42c9d0
mov edx, dword [esp + 0x18]
push edx
call fcn.0044b6e3
add esp, 4
xor eax, eax
jmp 0x42ca60
mov ebx, 1
test byte [0x4dfee0], bl
jne 0x42ca09
or dword [0x4dfee0], ebx
push 0x114
push esi
push 0x4dfeec
mov dword [0x4dfee8], esi
mov dword [0x4e0000], esi
call fcn.0044e9d0
add esp, 0xc
cmp dword [0x4e0000], esi
mov esi, dword [esp + 0x18]
cmp dword [esp + 0x2c], edi
jae 0x42ca1d
lea esi, [esp + 0x18]
test byte [0x4e0648], bl
jne 0x42ca3d
or dword [0x4e0648], ebx
call fcn.0042c800
push 0x46afa0
call fcn.0044bd1c
add esp, 4
push 0x4e0650
mov eax, esi
call fcn.0042e290
mov esi, eax
cmp dword [esp + 0x2c], edi
jb 0x42ca5e
mov eax, dword [esp + 0x18]
push eax
call fcn.0044b6e3
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0044b6ee
mov esp, ebp
pop ebp
ret
Function at 0x42ca80
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x468fa8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
push edi
mov eax, dword [0x4832f0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor esi, esi
xor eax, eax
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], esi
mov word [esp + 0x14], ax
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x3c], esi
call fcn.0040a010
add esp, 4
test eax, eax
je 0x42caf5
cmp dword [esp + 0x28], 8
mov eax, dword [esp + 0x14]
jae 0x42caea
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42cb10
cmp dword [esp + 0x28], 8
jb 0x42cb09
mov edx, dword [esp + 0x14]
push edx
call fcn.0044b6e3
add esp, 4
xor eax, eax
jmp 0x42cbb2
test byte [0x4dfee0], 1
jne 0x42cb3f
or dword [0x4dfee0], 1
push 0x114
push esi
push 0x4dfeec
mov dword [0x4dfee8], esi
mov dword [0x4e0000], esi
call fcn.0044e9d0
add esp, 0xc
mov eax, dword [esp + 0x28]
mov edi, dword [esp + 0x14]
mov ebx, edi
cmp eax, 8
jae 0x42cb54
lea ebx, [esp + 0x14]
mov edi, ebx
test byte [0x4e0648], 1
jne 0x42cb76
or dword [0x4e0648], 1
call fcn.0042c800
push 0x46afa0
call fcn.0044bd1c
add esp, 4
cmp dword [0x4e0654], esi
je 0x42cb9c
call fcn.0042f970
call fcn.0042e030
call fcn.0042df80
mov ecx, edi
push ebx
mov edi, 0x4e0650
call fcn.0042f5b0
mov esi, eax
cmp dword [esp + 0x28], 8
jb 0x42cbb0
mov eax, dword [esp + 0x14]
push eax
call fcn.0044b6e3
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x2c
ret

Function at 0x42cc60
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x810
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x808], eax
xor eax, eax
push esi
test edi, edi
je 0x42cd72
push 0x3fe
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.0044e9d0
add esp, 0xc
call fcn.004061c0
cmp eax, 5
jbe 0x42ccff
xor edx, edx
push 0x3fe
push edx
lea eax, [esp + 0x412]
push eax
mov word [esp + 0x414], dx
call fcn.0044e9d0
add esp, 0xc
lea ecx, [esp + 0x408]
push ecx
call fcn.0042d320
test eax, eax
je 0x42cce7
lea edx, [esp + 8]
push edx
lea esi, [esp + 0x40c]
call fcn.0042cd90
test eax, eax
jne 0x42cd12
xor eax, eax
pop esi
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x810
ret
lea eax, [esp + 8]
push eax
mov esi, str.http
call fcn.0042cd90
test eax, eax
je 0x42cd4f
xor ecx, ecx
cmp cx, word [esp + 8]
je 0x42cce7
lea edx, [esp + 4]
push edx
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0xc], ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
je 0x42cce7
mov eax, dword [esi]
push eax
mov ecx, 0x103
mov edx, edi
call fcn.00402eb0
push esi
test eax, eax
jge 0x42cd67
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x810
ret
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
mov ecx, dword [esp + 0x80c]
pop esi
xor ecx, esp
call fcn.0044b6ee
add esp, 0x810
ret
Function at 0x42d4c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
lea eax, [esp + 0xc]
push eax
push 1
push 0
mov dword [esp + 0x18], 0
call fcn.0040a800
add esp, 0xc
test eax, eax
jne 0x42d51d
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x1c]
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x42d50c
test ebx, ebx
jne 0x42d50c
cmp esi, 2
jne 0x42d50c
xor esi, esi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x42d51b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
ret 0xc

Function at 0x42d5d0
Capabilities:
Create thread

Disassembly:
cmp dword [esp + 4], 0
jne 0x42d638
mov eax, dword [0x4e0b08]
test eax, eax
je 0x42d600
push 0x3e8
push eax
mov dword [0x4e0b0c], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [0x4e0b08], 0
test byte [0x4e0008], 1
jne 0x42d61a
or dword [0x4e0008], 1
mov dword [0x4e000c], 0x4e0004
call fcn.0042cbd0
call fcn.00403820
cmp dword [eax + 4], 0
je 0x42d668
add eax, 0x14
call fcn.00404ad0
mov eax, 1
ret
cmp dword [0x4e0b08], 0
jne 0x42d668
push 0
push 0
push 0x4e0b0c
push 0x42d530
push 0
push 0
mov dword [0x4e0b0c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4e0b08], eax
mov eax, 1
ret
Function at 0x42e290
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x20
push ebx
mov ebx, dword [esp + 0x28]
push ebp
push esi
push edi
xor edi, edi
mov esi, eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x34], edi
cmp dword [ebx + 4], edi
jne 0x42e41f
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x42e2b3
sub eax, edx
sar eax, 1
push eax
push esi
lea esi, [ebx + 0x210]
call fcn.004018a0
lea esi, [ebx + 0x248]
mov eax, esi
call fcn.0042f700
lea ebp, [ebx + 0x22c]
mov eax, ebp
call fcn.0042f700
push 0x208
lea edi, [ebx + 8]
push 0
push edi
call fcn.0044e9d0
xor eax, eax
add esp, 0xc
test byte [0x4dfee0], 1
mov dword [ebx], eax
jne 0x42e32d
or dword [0x4dfee0], 1
push 0x114
push eax
push 0x4dfeec
mov dword [0x4dfee8], eax
mov dword [0x4e0000], eax
call fcn.0044e9d0
add esp, 0xc
mov edx, 0x4dfee8
call fcn.00431920
test eax, eax
jne 0x42e34a
mov eax, 3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
call fcn.0042e170
cmp eax, 1
jne 0x42e424
call fcn.00431a60
test eax, eax
jne 0x42e370
mov eax, 6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x42e3fc
mov eax, dword [esp + 0x18]
push ebx
mov dword [ebx], eax
call fcn.0042db10
mov edi, 8
cmp dword [esi + 0x18], edi
jb 0x42e3aa
mov esi, dword [esi + 4]
jmp 0x42e3ad
add esi, 4
mov ecx, dword [ebx + 0x268]
push esi
push ecx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp dword [ebp + 0x18], edi
jb 0x42e3c5
mov ebp, dword [ebp + 4]
jmp 0x42e3c8
add ebp, 4
mov ecx, dword [ebx + 0x268]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x38]
push eax
push 0
push 0x2001f
push 1
push 0
push 0
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x42e408
mov edx, dword [esp + 0x34]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
call fcn.0042dee0
mov eax, dword [esp + 0x34]
push eax
mov dword [ebx + 4], 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x42fac0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x168
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x164], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push 0xec
lea eax, [esp + 0x10]
push esi
push eax
mov dword [esp + 0x14], esi
call fcn.0044e9d0
add esp, 0xc
mov dword [esp + 0xf8], esi
cmp edi, esi
je 0x42fc13
cmp ebx, 0x10
jb 0x42fc13
test bl, 0xf
jne 0x42fc13
lea ecx, [edi + 0x10]
push ecx
lea eax, [ebx - 0x10]
lea ecx, [esp + 0x104]
mov dword [esp + 0x118], esi
mov dword [esp + 0x114], esi
mov dword [esp + 0x104], 0x67452301
mov dword [esp + 0x108], 0xefcdab89
mov dword [esp + 0x10c], 0x98badcfe
mov dword [esp + 0x110], 0x10325476
call fcn.00419570
add esp, 4
lea esi, [esp + 0x100]
lea ecx, [esp + 0x15c]
call fcn.00419610
mov edx, dword [esp + 0x15c]
mov eax, dword [esp + 0x160]
mov ecx, dword [esp + 0x164]
mov dword [edi], edx
mov edx, dword [esp + 0x168]
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
lea edx, [esp + 8]
mov eax, 0x4b48e8
call fcn.00416f00
mov ecx, dword [0x4b48fc]
mov edx, dword [0x4b4900]
mov eax, dword [0x4b48f8]
mov dword [esp + 0x160], ecx
lea ecx, [esp + 0x15c]
push ecx
mov dword [esp + 0x160], eax
mov eax, dword [0x4b4904]
mov dword [esp + 0x168], edx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x170], eax
push ebx
mov eax, edi
mov ecx, edi
call fcn.00417ea0
add esp, 0xc
mov al, 1
pop esi
pop ebx
mov ecx, dword [esp + 0x164]
xor ecx, esp
call fcn.0044b6ee
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x16c]
pop esi
pop ebx
xor ecx, esp
xor al, al
call fcn.0044b6ee
mov esp, ebp
pop ebp
ret
Function at 0x42fd40
Capabilities:
Set registry value

Disassembly:
sub esp, 0x220
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x21c], eax
push ebx
mov ebx, dword [esp + 0x228]
push ebp
push esi
push edi
xor edi, edi
push 0x208
lea eax, [esp + 0x24]
push edi
push eax
mov esi, ecx
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x20], edi
xor ebp, ebp
call fcn.0044e9d0
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
push edi
push 0x2001f
push 1
push edi
push edi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push 0x80000002
call esi
test eax, eax
jne 0x42fe56
push 0x4763f8
push ebx
lea eax, [esp + 0x28]
push str._s_s
push eax
mov ecx, 0x104
mov dword [esp + 0x28], edi
call fcn.00402ee0
add esp, 0x10
test eax, eax
jl 0x42fe56
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x18]
push edx
push edi
push 0x2001f
push 1
push edi
push edi
lea eax, [esp + 0x3c]
push eax
push ecx
call esi
test eax, eax
jne 0x42fe56
mov eax, str.360seURL
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x42fe03
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
mov eax, dword [esp + 0x14]
push edx
push str.360seURL
push 1
push edi
push str.Progid
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x42fe56
call fcn.004022c0
call fcn.00431850
test eax, eax
je 0x42fe51
mov ecx, dword [esp + 0x14]
push ecx
mov ecx, ebx
call fcn.00430c30
test eax, eax
je 0x42fe56
mov ebp, 1
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
je 0x42fe67
push eax
call esi
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x42fe72
push eax
call esi
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.0044b6ee
add esp, 0x220
ret 4
Function at 0x42fe90
Capabilities:
Delete registry key
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x46a14b
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x430], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4832f0]
xor eax, esp
push eax
lea eax, [esp + 0x44c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x45c]
xor edi, edi
xor eax, eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], edi
mov word [esp + 0x2c], ax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x1c]
push edx
push edi
push 0x2001f
push 1
push edi
push edi
push ebx
mov dword [esp + 0x474], edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push 0x80000002
call esi
test eax, eax
jne 0x42ffdc
mov eax, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
push edi
push 1
push edi
push str.URL_Protocol
push eax
call ebp
test eax, eax
jne 0x42ffdc
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x24]
push edx
push edi
push 0x2001f
push 1
push edi
push edi
push str.shellopencommand
push eax
call esi
test eax, eax
jne 0x42ffdc
lea eax, [esp + 0x28]
call fcn.0040a160
test eax, eax
je 0x42ffdc
cmp dword [esp + 0x40], 8
mov eax, dword [esp + 0x2c]
jae 0x42ff83
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x48]
push str.__s________1_
push ecx
mov ecx, 0x200
call fcn.00402ee0
add esp, 0xc
test eax, eax
jl 0x42ffdc
lea eax, [esp + 0x44]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x42ffa6
mov ecx, dword [esp + 0x20]
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [esp + 0x48]
push eax
push 1
push edi
push 0x474a60
push ecx
call ebp
test eax, eax
jne 0x42ffdc
mov dword [esp + 0x1c], 1
jmp 0x42ffe8
push ebx
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
je 0x42fff9
push eax
call esi
mov eax, dword [esp + 0x20]
cmp eax, edi
je 0x430004
push eax
call esi
cmp dword [esp + 0x40], 8
jb 0x430018
mov edx, dword [esp + 0x2c]
push edx
call fcn.0044b6e3
add esp, 4
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x44c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x430]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x444
ret 4
Function at 0x430c30
Capabilities:
Check if file exists
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x46a6e0
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4832f0]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x64]
mov esi, ecx
mov eax, 7
xor edi, edi
xor ecx, ecx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], edi
mov word [esp + 0x38], cx
mov dword [esp + 0x5c], edi
xor edx, edx
xor ebp, ebp
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], edi
mov word [esp + 0x1c], dx
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x60], 1
call fcn.0040a010
add esp, 4
test eax, eax
je 0x430cc3
cmp dword [esp + 0x30], 8
mov eax, dword [esp + 0x1c]
jae 0x430cb8
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x430d08
mov esi, 8
cmp dword [esp + 0x30], esi
jb 0x430cdb
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0044b6e3
add esp, 4
xor edx, edx
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], edi
mov word [esp + 0x1c], dx
cmp dword [esp + 0x4c], esi
jb 0x430d01
mov eax, dword [esp + 0x38]
push eax
call fcn.0044b6e3
add esp, 4
xor eax, eax
jmp 0x430dcf
push str..html
push str.360seURL
call fcn.0044b912
add esp, 8
test eax, eax
je 0x430d4b
push str..htm
push str.360seURL
call fcn.0044b912
add esp, 8
test eax, eax
je 0x430d4b
cmp dword [esp + 0x30], 8
mov eax, dword [esp + 0x1c]
jae 0x430d43
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x34]
push ecx
push eax
jmp 0x430d51
lea edx, [esp + 0x34]
push edx
push edi
mov edx, str.360seURL
mov ecx, esi
call fcn.0042c570
mov esi, 8
cmp eax, edi
je 0x430d94
mov eax, dword [esp + 0x38]
cmp dword [esp + 0x4c], esi
jae 0x430d74
lea eax, [esp + 0x38]
mov ecx, dword [esp + 0x48]
lea edx, [ecx + ecx + 2]
push edx
push eax
push 1
push edi
push str.Hash
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x430d94
lea ebp, [eax + 1]
cmp dword [esp + 0x30], esi
jb 0x430da7
mov eax, dword [esp + 0x1c]
push eax
call fcn.0044b6e3
add esp, 4
xor ecx, ecx
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], edi
mov word [esp + 0x1c], cx
cmp dword [esp + 0x4c], esi
jb 0x430dcd
mov edx, dword [esp + 0x38]
push edx
call fcn.0044b6e3
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x4c
ret 4