joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429c30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov byte [esp + 4], cl
mov dword [esp], edx
mov edi, eax
mov ecx, edi
movzx eax, byte [esp]
mov byte [esp + 5], al
mov edx, edi
shr edx, 8
mov eax, dword [esp]
shr eax, 8
mov byte [esp + 6], al
mov eax, edi
shr eax, 0x10
mov ebx, dword [esp]
shr ebx, 0x10
mov byte [esp + 7], bl
xor esi, esi
cmp byte [esp + 4], 0
je 0x429cc4
movzx ebx, cl
movzx ebp, byte [esp + 5]
add ebx, ebp
cmp ebx, 0xff
jbe 0x429c88
inc esi
mov cl, 0xff
jmp 0x429c8c
add cl, byte [esp + 5]
movzx ebx, dl
movzx ebp, byte [esp + 6]
add ebx, ebp
cmp ebx, 0xff
jbe 0x429ca3
inc esi
mov dl, 0xff
jmp 0x429ca7
add dl, byte [esp + 6]
movzx ebx, al
movzx ebp, byte [esp + 7]
add ebx, ebp
cmp ebx, 0xff
jbe 0x429cbe
inc esi
mov al, 0xff
jmp 0x429cf1
add al, byte [esp + 7]
jmp 0x429cf1
cmp cl, byte [esp + 5]
jae 0x429ccf
inc esi
xor ecx, ecx
jmp 0x429cd3
sub cl, byte [esp + 5]
cmp dl, byte [esp + 6]
jae 0x429cde
inc esi
xor edx, edx
jmp 0x429ce2
sub dl, byte [esp + 6]
cmp al, byte [esp + 7]
jae 0x429ced
inc esi
xor eax, eax
jmp 0x429cf1
sub al, byte [esp + 7]
dec esi
jle 0x429d08
movzx ecx, byte [esp + 4]
xor cl, 1
mov edx, dword [esp]
mov eax, edi
call fcn.00429c30
jmp 0x429d1b
movzx eax, al
shl eax, 0x10
movzx edx, dl
shl edx, 8
add eax, edx
movzx edx, cl
add eax, edx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42af1c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42b027
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, 0x10
call fcn.0040ad00
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x30]
sub eax, 0x2e
mov dword [esi + 8], eax
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x42af9a
push 0x410
push esi
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0042b144
mov eax, dword [ebp - 4]
call fcn.00406d78
push eax
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0042b144
mov eax, dword [ebp - 8]
call fcn.00406a94
push eax
push edi
call sub.user32.dll_DrawTextW
jmp 0x42afec
push 0x410
push esi
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.0042b144
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov ecx, 0
call fcn.00406c4c
mov eax, dword [ebp - 0xc]
call fcn.00405e00
push eax
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.0042b144
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov ecx, 0
call fcn.00406c4c
mov eax, dword [ebp - 0x14]
call fcn.004061fc
push eax
push edi
call sub.user32.dll_DrawTextA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42b02e
lea eax, [ebp - 0x18]
call fcn.004069f8
lea eax, [ebp - 0x14]
call fcn.00405a3c
lea eax, [ebp - 0x10]
call fcn.004069f8
lea eax, [ebp - 0xc]
call fcn.00405a3c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406a00
ret

Function at 0x42b500
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42b5df
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x14], 0
je 0x42b5bf
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x42b56d
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x14]
push eax
call sub.user32.dll_SendMessageW
mov edx, eax
inc edx
lea eax, [ebx + 0x50]
call fcn.00406d84
mov eax, dword [ebx + 0x50]
push eax
mov eax, dword [ebx + 0x50]
call fcn.00406d78
push eax
push 0xd
mov eax, dword [ebx + 0x14]
push eax
call sub.user32.dll_SendMessageW
mov edx, eax
lea eax, [ebx + 0x50]
call fcn.00406d84
jmp 0x42b5bf
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x14]
push eax
call sub.user32.dll_SendMessageA
mov edx, eax
inc edx
lea eax, [ebp - 4]
xor ecx, ecx
call fcn.0040639c
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405c68
call fcn.00405e00
push eax
push 0xd
mov eax, dword [ebx + 0x14]
push eax
call sub.user32.dll_SendMessageA
mov edx, eax
lea eax, [ebp - 4]
xor ecx, ecx
call fcn.0040639c
lea eax, [ebx + 0x50]
mov edx, dword [ebp - 4]
call fcn.00406c24
mov eax, esi
mov edx, dword [ebx + 0x50]
call fcn.00406a08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42b5e6
lea eax, [ebp - 4]
call fcn.00405a3c
ret
Function at 0x4357a0
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x220], edx
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x210], edx
mov dword [ebp - 0x214], edx
mov dword [ebp - 0x218], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x435a12
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x4358de
lea eax, [ebp - 0x20a]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
test eax, eax
jbe 0x435826
mov eax, ebx
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00406c08
jmp 0x43582f
mov eax, ebx
xor edx, edx
call fcn.00406a08
cmp dword [ebx], 0
jne 0x435842
mov ecx, ebx
xor edx, edx
mov eax, 0x1a
call fcn.00437b60
cmp dword [ebx], 0
je 0x4359ce
push 0
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_CreateDirectoryW
mov eax, dword [ebx]
call fcn.00406d78
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x435876
mov eax, ebx
mov edx, 0x435a2c
call fcn.00406e1c
push dword [ebx]
lea edx, [ebp - 0x218]
xor eax, eax
call fcn.004354e8
mov eax, dword [ebp - 0x218]
lea edx, [ebp - 0x214]
call fcn.0040f4b0
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x210]
call fcn.0043559c
push dword [ebp - 0x210]
push 0x435a3c
mov eax, ebx
mov edx, 3
call fcn.00406fc0
push 0
mov eax, dword [ebx]
call fcn.00406a94
push eax
call sub.kernel32.dll_CreateDirectoryW
mov eax, ebx
mov edx, 0x435a2c
call fcn.00406e1c
jmp 0x4359ce
lea eax, [ebp - 0x20a]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
test eax, eax
jbe 0x4359c5
lea eax, [ebp - 0x21c]
lea esi, [ebp - 0x20a]
mov edx, esi
mov ecx, 0
call fcn.00405d20
mov edx, dword [ebp - 0x21c]
mov eax, ebx
call fcn.00406c24
cmp dword [ebx], 0
je 0x4359ce
push 0
push esi
call sub.kernel32.dll_CreateDirectoryA
mov eax, dword [ebx]
call fcn.00406d78
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x43594a
mov eax, ebx
mov edx, 0x435a2c
call fcn.00406e1c
push dword [ebx]
lea edx, [ebp - 0x228]
xor eax, eax
call fcn.004354e8
mov eax, dword [ebp - 0x228]
lea edx, [ebp - 0x224]
call fcn.0040f4b0
mov eax, dword [ebp - 0x224]
lea edx, [ebp - 0x220]
call fcn.0043559c
push dword [ebp - 0x220]
push 0x435a3c
mov eax, ebx
mov edx, 3
call fcn.00406fc0
push 0
lea eax, [ebp - 0x22c]
mov edx, dword [ebx]
mov ecx, 0
call fcn.00406c4c
mov eax, dword [ebp - 0x22c]
call fcn.004061fc
push eax
call sub.kernel32.dll_CreateDirectoryA
mov eax, ebx
mov edx, 0x435a2c
call fcn.00406e1c
jmp 0x4359ce
mov eax, ebx
xor edx, edx
call fcn.00406a08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435a19
lea eax, [ebp - 0x22c]
call fcn.00405a3c
lea eax, [ebp - 0x228]
mov edx, 3
call fcn.00406a00
lea eax, [ebp - 0x21c]
call fcn.00405a3c
lea eax, [ebp - 0x218]
mov edx, 3
call fcn.00406a00
ret
Function at 0x435a54
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd8c
push ebx
xor eax, eax
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x264], eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x435ca3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.004357a0
cmp dword [ebp - 4], 0
je 0x435c6d
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x435b71
mov eax, dword [ebp - 4]
call fcn.00406a94
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x435c6d
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x258]
mov ecx, 0x435cbc
mov edx, dword [ebp - 4]
call fcn.00406edc
mov eax, dword [ebp - 0x258]
call fcn.00406a94
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x435b5e
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x228]
mov ecx, 0x104
call fcn.00406c08
mov ecx, dword [ebp - 0x260]
lea eax, [ebp - 0x25c]
mov edx, dword [ebp - 4]
call fcn.00406edc
mov eax, dword [ebp - 0x25c]
call fcn.00406a94
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x254]
push eax
push ebx
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x435b0c
push ebx
call sub.kernel32.dll_FindClose_1
mov eax, dword [ebp - 4]
call fcn.00406a94
push eax
call sub.kernel32.dll_RemoveDirectoryW
jmp 0x435c6d
lea eax, [ebp - 0x264]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.00406c4c
mov eax, dword [ebp - 0x264]
call fcn.004061fc
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x435c6d
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x268]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.00406c4c
lea eax, [ebp - 0x268]
mov edx, 0x435cd0
call fcn.00405e34
mov eax, dword [ebp - 0x268]
call fcn.004061fc
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x435c49
lea eax, [ebp - 0x26c]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.00406c4c
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x270]
lea edx, [ebp - 0x254]
add edx, 0x2c
mov ecx, 0x104
push 0
call fcn.00405da4
mov edx, dword [ebp - 0x270]
pop eax
call fcn.00405e34
mov eax, dword [ebp - 0x26c]
call fcn.004061fc
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x254]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x435be0
push ebx
call sub.kernel32.dll_FindClose_1
lea eax, [ebp - 0x274]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.00406c4c
mov eax, dword [ebp - 0x274]
call fcn.004061fc
push eax
call sub.kernel32.dll_RemoveDirectoryA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435caa
lea eax, [ebp - 0x274]
mov edx, 5
call fcn.00405a60
lea eax, [ebp - 0x260]
mov edx, 3
call fcn.00406a00
lea eax, [ebp - 4]
call fcn.004069f8
ret
Function at 0x435cd4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
xor edx, edx
mov dword [ebp - 0x214], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x435d79
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x104
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x435d2d
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20e]
push eax
call sub.kernel32.dll_GetComputerNameW
mov eax, ebx
lea edx, [ebp - 0x20e]
mov ecx, 0x105
call fcn.00406c08
jmp 0x435d60
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20e]
push eax
call sub.kernel32.dll_GetComputerNameA
lea eax, [ebp - 0x214]
lea edx, [ebp - 0x20e]
mov ecx, 0
call fcn.00405d20
mov edx, dword [ebp - 0x214]
mov eax, ebx
call fcn.00406c24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435d80
lea eax, [ebp - 0x214]
call fcn.00405a3c
ret
Function at 0x435d88
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x435f45
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
xor edx, edx
call fcn.00406a08
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x435e66
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, edi
call fcn.00406a94
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x435f2a
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00406a94
mov edi, eax
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x435e58
cmp dword [ebp - 0xc], 0
je 0x435e58
mov eax, dword [ebp - 0xc]
add eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x435e52
mov eax, ebx
mov edx, esi
call fcn.00406bb4
push esi
call sub.kernel32.dll_LocalFree
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x435f2a
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x14]
mov edx, edi
mov ecx, 0
call fcn.00406c4c
mov eax, dword [ebp - 0x14]
call fcn.004061fc
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x435f2a
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.00406c4c
mov eax, dword [ebp - 0x18]
call fcn.004061fc
mov edi, eax
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x435f21
cmp dword [ebp - 0xc], 0
je 0x435f21
mov eax, dword [ebp - 0xc]
add eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x435f1b
lea eax, [ebp - 0x1c]
mov edx, esi
mov ecx, 0
call fcn.00405d20
mov edx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.00406c24
push esi
call sub.kernel32.dll_LocalFree
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435f4c
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00405a60
ret
Function at 0x435f58
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov esi, eax
mov eax, dword [ebp + 8]
call fcn.004069f0
xor eax, eax
push ebp
push 0x4360c7
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x436007
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, edi
call fcn.00406a94
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExW
test eax, eax
jne 0x43609c
lea eax, [ebp + 8]
call fcn.00405c38
call fcn.00406d78
add eax, eax
add eax, 2
push eax
mov eax, dword [ebp + 8]
call fcn.00406a94
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00406a94
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x43609c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x14]
mov edx, edi
mov ecx, 0
call fcn.00406c4c
mov eax, dword [ebp - 0x14]
call fcn.004061fc
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x43609c
lea eax, [ebp - 4]
mov edx, dword [ebp + 8]
mov ecx, 0
call fcn.00406c4c
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405c68
call fcn.00405e00
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.004061fc
push eax
push 1
push 0
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
mov ecx, 0
call fcn.00406c4c
mov eax, dword [ebp - 0x18]
call fcn.004061fc
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4360ce
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00405a60
lea eax, [ebp - 4]
call fcn.00405a3c
lea eax, [ebp + 8]
call fcn.004069f8
ret
Function at 0x4360dc
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4361c7
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x43614f
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov eax, edi
call fcn.00406a94
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4361ac
mov eax, dword [ebp - 4]
call fcn.00406a94
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4361ac
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0xc]
mov edx, edi
mov ecx, 0
call fcn.00406c4c
mov eax, dword [ebp - 0xc]
call fcn.004061fc
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4361ac
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.00406c4c
mov eax, dword [ebp - 0x10]
call fcn.004061fc
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4361ce
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00405a60
ret

Function at 0x436860
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0041a78c
test eax, eax
je 0x436911
cmp word [eax + 0x18], 0x20b
jne 0x43689e
add eax, 0x18
add eax, 0x78
mov edx, dword [eax]
mov esi, edx
add esi, dword [ebp - 4]
add edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
jmp 0x4368b0
add eax, 0x80
mov edx, dword [eax]
mov esi, edx
add esi, dword [ebp - 4]
add edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
test esi, esi
je 0x436911
jmp 0x43690b
mov eax, dword [esi + 0x10]
cmp eax, dword [ebp - 0x10]
jbe 0x4368c7
push ebp
call fcn.004366a0
pop ecx
jmp 0x436911
cmp dword [esi + 0x10], 0
je 0x436908
mov ebx, dword [ebp - 4]
add ebx, dword [esi + 0x10]
jmp 0x436903
cmp edi, dword [ebx]
jne 0x436900
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x436900
mov eax, dword [ebp - 8]
mov dword [ebx], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
add ebx, 4
cmp dword [ebx], 0
jne 0x4368d5
add esi, 0x14
cmp dword [esi + 0xc], 0
jne 0x4368b6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x437b60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x437ce5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
xor edx, edx
call fcn.00406a08
lea eax, [ebp - 4]
push eax
call sub.shell32.dll_SHGetMalloc
test eax, eax
jne 0x437cb9
lea eax, [ebp - 8]
push eax
push esi
push 0xffffffffffffffff
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x437cb9
cmp dword [0x617d0c], 0
jne 0x437be2
push 0x437cf4
push 0x437d20
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00409e4c
mov dword [0x617d0c], eax
cmp dword [0x617d0c], 0
je 0x437c14
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [0x617d0c]
test eax, eax
je 0x437c14
mov eax, edi
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.00406c08
jmp 0x437c4b
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x437c4b
lea eax, [ebp - 0x218]
lea edx, [ebp - 0x212]
mov ecx, 0
call fcn.00405d20
mov edx, dword [ebp - 0x218]
mov eax, edi
call fcn.00406c24
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
cmp dword [edi], 0
jne 0x437c77
lea edx, [ebp - 0x21c]
xor eax, eax
call fcn.004354e8
mov eax, dword [ebp - 0x21c]
mov edx, edi
call fcn.0040f4f0
cmp dword [edi], 0
je 0x437cb9
mov eax, dword [edi]
call fcn.00406d78
mov edx, dword [edi]
cmp word [edx + eax*2 - 2], 0x5c
sete al
cmp bl, al
je 0x437cb9
test bl, bl
je 0x437ca4
mov eax, edi
mov edx, 0x437d44
call fcn.00406e1c
jmp 0x437cb9
mov eax, dword [edi]
call fcn.00406d78
mov edx, eax
mov eax, edi
mov ecx, 1
call fcn.00407284
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x437cec
lea eax, [ebp - 0x21c]
call fcn.004069f8
lea eax, [ebp - 0x218]
call fcn.00405a3c
lea eax, [ebp - 4]
call fcn.00408d94
ret
Function at 0x438790
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004069f0
xor eax, eax
push ebp
push 0x438846
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4387c4
call sub.user32.dll_EmptyClipboard
call sub.user32.dll_CloseClipboard
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x438830
lea eax, [ebp - 4]
call fcn.00405c38
call fcn.00406d78
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov ebx, eax
push ebx
call sub.kernel32.dll_GlobalLock
mov esi, eax
test esi, esi
je 0x43882b
lea eax, [ebp - 4]
call fcn.00405c38
call fcn.00406d78
add eax, eax
add eax, 2
push eax
mov eax, dword [ebp - 4]
call fcn.00406a94
mov edx, esi
pop ecx
call fcn.004032cc
push ebx
call sub.kernel32.dll_GlobalUnlock
push ebx
push 0xd
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43884d
lea eax, [ebp - 4]
call fcn.004069f8
ret