joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416a90
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, 2
imul ecx, eax, 0
movzx edx, word [ecx + 0x645838]
test edx, edx
je 0x416ac9
push 0x645838
mov ecx, dword [ebp + 8]
call fcn.00410ef0
mov eax, dword [ebp - 4]
or eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
jmp 0x416b23
push 0
push 0x1a
push 0x645838
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ecx, dword [ebp + 0xc]
call fcn.0041b740
push eax
push 0x645838
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x645838
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x416b0a
push 0x645838
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push 0x645838
mov ecx, dword [ebp + 8]
call fcn.00410ef0
mov ecx, dword [ebp - 4]
or ecx, 1
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x416f00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c6f97
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x6403f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [ebp - 0x24], 0
je 0x416f45
mov dword [ebp - 0x18], 0x100
jmp 0x416f4c
mov dword [ebp - 0x18], 0x200
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x10], 0
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControl_
lea ecx, [ebp - 0x14]
call fcn.00407bc0
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x14]
call fcn.00407fe0
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [ebp - 0x28]
or ecx, 0x20006
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 0x14]
call fcn.00407f90
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x416fe0
mov dword [ebp - 0x1c], 0x5dfb1c
cmp dword [ebp - 0x1c], 0
je 0x416fe0
push 4
lea edx, [ebp + 0xc]
push edx
push 4
push 0
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x416fe0
mov dword [ebp - 0x20], 1
cmp dword [ebp - 0x10], 0
je 0x416ff0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00407db0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x41a900
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x41a909
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
shl edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41a94c
mov eax, dword [ebp - 8]
jmp 0x41a9b2
cmp dword [ebp - 0xc], 1
je 0x41a95f
cmp dword [ebp - 0xc], 2
je 0x41a95f
mov eax, 0xd
jmp 0x41a9b2
cmp dword [ebp + 0xc], 0
je 0x41a9a6
cmp dword [ebp - 4], 0
je 0x41a995
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x41a98c
mov edx, dword [ebp - 4]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x41a993
mov eax, 0xd
jmp 0x41a9b2
jmp 0x41a9a6
mov edx, 2
imul eax, edx, 0
xor ecx, ecx
mov edx, dword [ebp + 0xc]
mov word [edx + eax], cx
mov eax, dword [ebp - 4]
shr eax, 1
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41a9c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
xor eax, eax
jne 0x41a9c9
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x41a9fe
call fcn.00419b80
jmp 0x41aa14
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x41aa12
push 0x26
call fcn.00409ad0
add esp, 4
jmp 0x41aa14
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x41d480
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c76ee
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x6403f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x220], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x21c]
call fcn.00407c40
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x224]
call fcn.00407bc0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x224]
push edx
mov ecx, dword [ebp - 0x228]
call fcn.0041d310
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x224]
call fcn.00407db0
lea ecx, [ebp - 0x21c]
call fcn.004090e0
movzx eax, al
test eax, eax
je 0x41d52d
lea ecx, [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.00407f10
push str.officialwebsite
lea ecx, [ebp - 0x21c]
call fcn.00421720
test eax, eax
jne 0x41d585
lea edx, [ebp - 0x21c]
push edx
mov ecx, dword [ebp + 8]
call fcn.00407ba0
mov eax, dword [ebp - 0x220]
or eax, 1
mov dword [ebp - 0x220], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x21c]
call fcn.00407db0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.00407db0
mov eax, dword [ebp + 8]
jmp 0x41d653
push 0x208
push 0
lea ecx, [ebp - 0x218]
push ecx
call fcn.005163e0
add esp, 0xc
mov dword [ebp - 0x230], 1
mov dword [ebp - 0x22c], 0x104
lea edx, [ebp - 0x22c]
push edx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 0x5e0034
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, 2
imul ecx, eax, 0
movzx edx, word [ebp + ecx - 0x218]
test edx, edx
je 0x41d614
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.00407f30
lea ecx, [ebp - 0x21c]
call fcn.0041aba0
lea ecx, [ebp - 0x21c]
call fcn.0041aae0
lea ecx, [ebp - 0x21c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00407ba0
mov edx, dword [ebp - 0x220]
or edx, 1
mov dword [ebp - 0x220], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x21c]
call fcn.00407db0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.00407db0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004742a8
mov esp, ebp
pop ebp
ret 0x10
Function at 0x421ff0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x4220ad
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x422023
xor eax, eax
jmp 0x4220db
push 0x5e0404
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
push 0x5e0410
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
push 0x5e041c
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], eax
push 0x5e042c
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], eax
push 0x5e043c
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
je 0x4220ad
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
call ecx
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
je 0x4220d1
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 0
je 0x4220d1
mov edx, dword [ebp - 4]
cmp dword [edx + 0xc], 0
je 0x4220d1
mov dword [ebp - 8], 1
jmp 0x4220d8
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x425220
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 1
push 0
push 0
push 0x5e0650
push 0x5e05f4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x425250
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 1
push 0
push 0
push 0x5e06a8
push 0x5e070c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x428990
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0
push 0
push 0x429b40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esp, ebp
pop ebp
ret
Function at 0x42e2a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.0042ca80
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0x40]
call edx
cmp dword [ebp - 0xc], 1
jne 0x42e43d
mov eax, dword [ebp - 4]
cmp dword [eax + 0x68], 0
je 0x42e43d
lea ecx, [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.0042ee10
mov ecx, dword [ebp - 4]
call fcn.0042d440
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [eax + 0xf4]
call ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x42e335
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [eax + 0x84]
call edx
test eax, eax
je 0x42e43d
mov dword [ebp - 0xc], 2
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
je 0x42e355
mov dword [ebp - 0x14], 1
jmp 0x42e35c
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0
je 0x42e395
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x58], 0
jne 0x42e395
mov edx, dword [ebp - 4]
mov dword [edx + 0x58], 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x5c], 0
push 1
push 0
push 0x3401
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00427580
jmp 0x42e3bb
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x58], 0
je 0x42e3bb
mov edx, dword [ebp - 4]
cmp dword [edx + 0x5c], 0
jne 0x42e3bb
mov eax, dword [ebp - 4]
mov dword [eax + 0x58], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x5c], 1
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx edx, ax
and edx, 0x8000
je 0x42e3d7
mov dword [ebp - 0x18], 1
jmp 0x42e3de
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0x18], 0
je 0x42e417
mov eax, dword [ebp - 4]
cmp dword [eax + 0x60], 0
jne 0x42e417
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x60], 1
mov edx, dword [ebp - 4]
mov dword [edx + 0x5c], 0
push 1
push 1
push 0x3401
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.00427580
jmp 0x42e43d
mov eax, dword [ebp - 4]
cmp dword [eax + 0x60], 0
je 0x42e43d
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x5c], 0
jne 0x42e43d
mov edx, dword [ebp - 4]
mov dword [edx + 0x60], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x5c], 1
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x431a30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 4
push 0x5e0ac8
push 0x5e0acc
push 0
call fcn.00441c80
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 6
jne 0x431a68
push 1
push 0
push 0
push str.http:__abm.91toolbox.com
push 0x5e0b2c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret
Function at 0x4322a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x6403f4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
push 0
lea eax, [ebp - 0x414]
push eax
call fcn.005163e0
add esp, 0xc
mov dword [ebp - 0x41c], 1
mov dword [ebp - 0x418], 0x104
mov dword [ebp - 0x420], 0x5e10b0
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x41c]
push eax
push 0x5e10e0
mov ecx, dword [ebp - 0x420]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x43239e
mov edx, dword [ebp + 8]
push edx
call fcn.00421d70
mov ecx, eax
call fcn.0041c1e0
call fcn.00421d70
mov ecx, eax
call fcn.0041c850
push eax
call fcn.00434900
mov ecx, eax
call fcn.00410010
push str.installpkg
call fcn.00434900
mov ecx, eax
call fcn.0040ffd0
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.005163e0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [0x645b34]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call fcn.00434900
mov ecx, eax
call fcn.00410030
mov eax, 0xf
jmp 0x4323e2
mov ecx, 0x649c0c
call fcn.0040d300
test eax, eax
jne 0x4323b3
mov eax, 2
jmp 0x4323e2
push 0
push 1
mov ecx, dword [ebp + 8]
push ecx
push 0
mov edx, dword [0x645b34]
push edx
call fcn.004313e0
add esp, 0x14
mov dword [ebp - 0x424], eax
mov ecx, 0x649c0c
call fcn.0040d3f0
mov eax, dword [ebp - 0x424]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004742a8
mov esp, ebp
pop ebp
ret 4
Function at 0x435770
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x6403f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20c], ecx
push 0
lea ecx, [ebp - 0x21c]
call fcn.004194c0
mov eax, dword [ebp - 0x20c]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x20c]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.0041a860
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
je 0x4357ef
mov edx, dword [ebp - 0x208]
mov dword [ebp - 0x220], edx
lea ecx, [ebp - 0x21c]
call fcn.00419690
mov eax, dword [ebp - 0x220]
jmp 0x4358a4
mov dword [ebp - 0x210], 0x100
lea eax, [ebp - 0x230]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x204]
push edx
push 0
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x435873
lea ecx, [ebp - 0x204]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.00435770
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
je 0x435867
mov edx, dword [ebp - 0x208]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x21c]
call fcn.00419690
mov eax, dword [ebp - 0x224]
jmp 0x4358a4
mov dword [ebp - 0x210], 0x100
jmp 0x4357f9
lea ecx, [ebp - 0x21c]
call fcn.00419c30
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x20c]
call fcn.00434400
mov dword [ebp - 0x228], eax
lea ecx, [ebp - 0x21c]
call fcn.00419690
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004742a8
mov esp, ebp
pop ebp
ret 4

Function at 0x435980
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x4359df
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4359ac
mov eax, 1
jmp 0x4359fd
push str.RegDeleteKeyTransactedW
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4359dd
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0xc]
jmp 0x4359fd
jmp 0x4359f8
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x4359f8
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x4359fd
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x437050
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
xor eax, eax
jne 0x437059
cmp dword [ebp + 0xc], 0
je 0x43706c
mov dword [ebp - 0x10], 1
jmp 0x437073
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jne 0x437086
mov eax, 0xd
jmp 0x4370e3
xor edx, edx
jne 0x43705d
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.005328cf
add esp, 4
add eax, 1
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
lea ecx, [eax + edx*2]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
lea ecx, [eax + edx*2]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 8], 1
jne 0x437097
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 7
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8

Function at 0x4370f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
xor eax, eax
jne 0x4370f9
cmp dword [ebp + 0xc], 0
je 0x43710c
mov dword [ebp - 4], 1
jmp 0x437113
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jne 0x437126
mov eax, 0xd
jmp 0x437155
xor edx, edx
jne 0x4370fd
mov eax, dword [ebp + 0xc]
push eax
call fcn.005328cf
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x437eb0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x6403f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.005163e0
add esp, 0xc
mov dword [ebp - 0x214], 1
mov dword [ebp - 0x210], 0x104
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x214]
push eax
push 0x5e1740
push 0x5e1758
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x437f23
jmp 0x437f66
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x437f36
jmp 0x437f66
push 0x5e1788
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push str.three_end
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor ecx, ecx
jne 0x437ec9
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004742a8
mov esp, ebp
pop ebp
ret
Function at 0x4391b0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x6403f4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
push 0
lea eax, [ebp - 0x214]
push eax
call fcn.005163e0
add esp, 0xc
lea ecx, [ebp - 0x214]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0x214]
push eax
call fcn.005328cf
add esp, 4
test eax, eax
jne 0x439210
push 0
push 0
push 0x465
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
lea edx, [ebp - 0x214]
push edx
call fcn.005328cf
add esp, 4
cmp eax, 2
jb 0x4392b1
mov eax, 2
shl eax, 0
movzx ecx, word [ebp + eax - 0x214]
cmp ecx, 0x3a
jne 0x4392b1
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], edx
mov eax, 2
imul ecx, eax, 0
mov edx, 2
imul eax, edx, 0
mov cx, word [ebp + ecx - 0x214]
mov word [ebp + eax - 0xc], cx
mov edx, 2
shl edx, 0
mov eax, 0x3a
mov word [ebp + edx - 0xc], ax
mov ecx, 2
shl ecx, 1
mov edx, 0x5c
mov word [ebp + ecx - 0xc], dx
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 3
je 0x4392b1
push 0
push 0
push 0x465
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004742a8
mov esp, ebp
pop ebp
ret

Function at 0x43c080
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 1
push 0
push 0
push str.http:__abm.91toolbox.com_cms_agreement.html
push 0x5e1d6c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret

Function at 0x43ccc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 1
push 0
push 0
push str.http:__abm.91toolbox.com_cms_privacy_policy.html
push 0x5e21ac
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x43cd70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c9328
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x6403f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
push 1
push 0
push 0
push str.http:__abm.91toolbox.com_joinclub
push 0x5e221c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
sub esp, 0x28
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0
call fcn.004327a0
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
push 0
push 0
push str.click_feedgroup
call fcn.00434900
mov dword [ebp - 4], 0xffffffff
mov ecx, eax
call fcn.0040faa0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x10