joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414c80
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x436a98]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x234], ecx
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.0041c220
add esp, 0xc
push 0x104
lea edx, [ebp - 0x210]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHELL32.dll_DragFinish]
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x414df4
lea eax, [ebp - 0x210]
push eax
push 0x3ed
mov ecx, dword [ebp - 0x234]
add ecx, 4
call fcn.00415690
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x414d88
push 0
push 0x3f7
lea edx, [ebp - 0x218]
push edx
mov ecx, dword [ebp - 0x234]
add ecx, 4
call fcn.00403ed0
mov ecx, eax
call fcn.00418500
push eax
lea ecx, [ebp - 0x214]
call fcn.004155a0
mov ecx, eax
call fcn.00415570
push 1
push 0x3f8
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp - 0x234]
add ecx, 4
call fcn.00403ed0
mov ecx, eax
call fcn.00418500
push eax
lea ecx, [ebp - 0x21c]
call fcn.004155a0
mov ecx, eax
call fcn.00415570
jmp 0x414df4
push 1
push 0x3f7
lea ecx, [ebp - 0x228]
push ecx
mov ecx, dword [ebp - 0x234]
add ecx, 4
call fcn.00403ed0
mov ecx, eax
call fcn.00418500
push eax
lea ecx, [ebp - 0x224]
call fcn.004155a0
mov ecx, eax
call fcn.00415570
push 0
push 0x3f8
lea edx, [ebp - 0x230]
push edx
mov ecx, dword [ebp - 0x234]
add ecx, 4
call fcn.00403ed0
mov ecx, eax
call fcn.00418500
push eax
lea ecx, [ebp - 0x22c]
call fcn.004155a0
mov ecx, eax
call fcn.00415570
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c203
mov esp, ebp
pop ebp
ret 4
Function at 0x4156c0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c8b3
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0xbc
mov eax, dword [0x436a98]
xor eax, ebp
mov dword [ebp - 0x2c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0xc8], ecx
call fcn.0040fca0
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x28]
call fcn.0040a4b0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edx, dword [ebp + 8]
mov dword [edx], 0
mov eax, dword [ebp - 0xc8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0xb8]
call fcn.0040a4b0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
jle 0x415813
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x1c]
add edx, 1
push edx
lea ecx, [ebp - 0xb8]
call fcn.00415b10
jmp 0x415774
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xb8]
call fcn.00418500
test eax, eax
jne 0x4157bd
mov dword [ebp - 0xbc], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb8]
call fcn.00413420
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004131b0
mov eax, dword [ebp - 0xbc]
jmp 0x415886
mov eax, dword [ebp - 0x1c]
add eax, 1
push eax
lea ecx, [ebp - 0xb8]
call fcn.00418500
push eax
mov ecx, dword [ebp - 0xc8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x415813
mov dword [ebp - 0xc0], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb8]
call fcn.00413420
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004131b0
mov eax, dword [ebp - 0xc0]
jmp 0x415886
lea ecx, [ebp - 0xb8]
call fcn.00418500
push eax
call fcn.0040fcf0
add esp, 4
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
cmp dword [ebp - 0x1c], 0
jne 0x415845
mov dword [ebp - 0xcc], 1
jmp 0x415856
mov edx, dword [ebp + 8]
xor eax, eax
cmp dword [edx], 0
setne al
mov dword [ebp - 0xcc], eax
mov ecx, dword [ebp - 0xcc]
mov dword [ebp - 0xc4], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb8]
call fcn.00413420
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004131b0
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.0041c203
mov esp, ebp
pop ebp
ret 4
Function at 0x41577b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c8b3
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0xbc
mov eax, dword [0x436a98]
xor eax, ebp
mov dword [ebp - 0x2c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0xc8], ecx
call fcn.0040fca0
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x28]
call fcn.0040a4b0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edx, dword [ebp + 8]
mov dword [edx], 0
mov eax, dword [ebp - 0xc8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0xb8]
call fcn.0040a4b0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
jle 0x415813
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x1c]
add edx, 1
push edx
lea ecx, [ebp - 0xb8]
call fcn.00415b10
jmp 0x415774
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xb8]
call fcn.00418500
test eax, eax
jne 0x4157bd
mov dword [ebp - 0xbc], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb8]
call fcn.00413420
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004131b0
mov eax, dword [ebp - 0xbc]
jmp 0x415886
mov eax, dword [ebp - 0x1c]
add eax, 1
push eax
lea ecx, [ebp - 0xb8]
call fcn.00418500
push eax
mov ecx, dword [ebp - 0xc8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x415813
mov dword [ebp - 0xc0], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb8]
call fcn.00413420
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004131b0
mov eax, dword [ebp - 0xc0]
jmp 0x415886
lea ecx, [ebp - 0xb8]
call fcn.00418500
push eax
call fcn.0040fcf0
add esp, 4
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
cmp dword [ebp - 0x1c], 0
jne 0x415845
mov dword [ebp - 0xcc], 1
jmp 0x415856
mov edx, dword [ebp + 8]
xor eax, eax
cmp dword [edx], 0
setne al
mov dword [ebp - 0xcc], eax
mov ecx, dword [ebp - 0xcc]
mov dword [ebp - 0xc4], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb8]
call fcn.00413420
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004131b0
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.0041c203
mov esp, ebp
pop ebp
ret 4
Function at 0x415bc0
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x436a98]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x62c], ecx
push 0
mov ecx, dword [ebp - 0x62c]
add ecx, 4
call fcn.00402840
push 0
push 0xc
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 0xb
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 1
push 0x80
mov ecx, 0x437da4
call fcn.00403e10
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
mov dword [ebp - 4], eax
push 1
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x62c]
add ecx, 4
call fcn.00403f30
push 0
push 0x32
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 0x31
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 1
push 0x80
mov ecx, 0x437da4
call fcn.00403e10
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
mov dword [ebp - 0x214], eax
push 0
mov ecx, dword [ebp - 0x214]
push ecx
mov ecx, dword [ebp - 0x62c]
add ecx, 4
call fcn.00403f30
push 2
push 0
push 0
push 0x2001
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov edx, dword [ebp - 0x62c]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor ecx, ecx
mov word [ebp - 0x628], cx
push 0x206
push 0
lea edx, [ebp - 0x626]
push edx
call fcn.0041c220
add esp, 0xc
push 0x104
lea eax, [ebp - 0x628]
push eax
push 0x42e640
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebp - 0x628]
push ecx
push 0x3f3
mov ecx, dword [ebp - 0x62c]
add ecx, 4
call fcn.00415690
xor edx, edx
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.0041c220
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push 0x42e664
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor edx, edx
mov word [ebp - 0x420], dx
push 0x206
push 0
lea eax, [ebp - 0x41e]
push eax
call fcn.0041c220
add esp, 0xc
lea ecx, [ebp - 0x210]
push ecx
push 0x104
lea edx, [ebp - 0x420]
push edx
call fcn.0041bdae
add esp, 0xc
push 0x42e688
lea eax, [ebp - 0x420]
push eax
call fcn.00403be0
add esp, 8
lea ecx, [ebp - 0x420]
push ecx
push 0
push 0x42e6a4
push 0x42e6b8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push eax
push 0x3fb
mov ecx, dword [ebp - 0x62c]
add ecx, 4
call fcn.00403e80
lea edx, [ebp - 0x420]
push edx
push 0
push 0x42e6c8
push 0x42e6f0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push eax
push 0x414
mov ecx, dword [ebp - 0x62c]
add ecx, 4
call fcn.00403e80
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041c203
mov esp, ebp
pop ebp
ret 0xc
Function at 0x415de0
Capabilities:
Create directory
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c92b
mov eax, dword fs:[0]
push eax
sub esp, 0x628
mov eax, dword [0x436a98]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x634], ecx
xor eax, eax
mov word [ebp - 0x62c], ax
push 0x206
push 0
lea ecx, [ebp - 0x62a]
push ecx
call fcn.0041c220
add esp, 0xc
push 0x104
lea edx, [ebp - 0x62c]
push edx
push 0x3f3
mov ecx, dword [ebp - 0x634]
add ecx, 4
call fcn.004166f0
lea eax, [ebp - 0x62c]
push eax
push str.KZMOUNT_INDEXPATH
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor ecx, ecx
mov word [ebp - 0x21c], cx
push 0x206
push 0
lea edx, [ebp - 0x21a]
push edx
call fcn.0041c220
add esp, 0xc
push 0x104
lea eax, [ebp - 0x21c]
push eax
push 0x42e724
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor edx, edx
mov word [ebp - 0x424], dx
push 0x206
push 0
lea eax, [ebp - 0x422]
push eax
call fcn.0041c220
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
push 0x104
lea edx, [ebp - 0x424]
push edx
call fcn.0041bdae
add esp, 0xc
push str.KZMount.ini
lea eax, [ebp - 0x424]
push eax
call fcn.00403be0
add esp, 8
lea ecx, [ebp - 0x424]
push ecx
lea edx, [ebp - 0x62c]
push edx
push str.IndexPath
push 0x42e778
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x630]
call fcn.00403fe0
mov dword [ebp - 4], 0
push 0x3fb
mov ecx, dword [ebp - 0x634]
add ecx, 4
call fcn.00403eb0
push eax
push 0x42e788
lea eax, [ebp - 0x630]
push eax
call fcn.00404000
add esp, 0xc
lea ecx, [ebp - 0x424]
push ecx
lea ecx, [ebp - 0x630]
call fcn.00418500
push eax
push str.AutoOpen
push 0x42e7a4
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x414
mov ecx, dword [ebp - 0x634]
add ecx, 4
call fcn.00403eb0
push eax
push 0x42e7b4
lea edx, [ebp - 0x630]
push edx
call fcn.00404000
add esp, 0xc
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x630]
call fcn.00418500
push eax
push str.DisableExitWarning
push str.KZMount
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x634]
call fcn.004036b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x630]
call fcn.00404a50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c203
mov esp, ebp
pop ebp
ret 0xc
Function at 0x416170
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x436a98]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.0041c220
add esp, 0xc
push 0x104
lea edx, [ebp - 0x210]
push edx
push str._APPDATA_KZMount
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x210]
push eax
push 0x3f3
mov ecx, dword [ebp - 0x214]
add ecx, 4
call fcn.00415690
push 0
push 0x3fb
mov ecx, dword [ebp - 0x214]
add ecx, 4
call fcn.00403e80
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c203
mov esp, ebp
pop ebp
ret 0x10

Function at 0x416200
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c963
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x436a98]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x22c], ecx
lea ecx, [ebp - 0x10]
call fcn.0040a4b0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0040a4b0
mov byte [ebp - 4], 1
push 0x27f8
lea ecx, [ebp - 0x10]
call fcn.00403c00
push 0x27f9
lea ecx, [ebp - 0x14]
call fcn.00403c00
push 4
lea ecx, [ebp - 0x10]
call fcn.00418500
push eax
lea ecx, [ebp - 0x14]
call fcn.00418500
push eax
mov ecx, dword [ebp - 0x22c]
add ecx, 4
call fcn.00403f00
cmp eax, 6
jne 0x41630a
xor eax, eax
mov word [ebp - 0x224], ax
push 0x206
push 0
lea ecx, [ebp - 0x222]
push ecx
call fcn.0041c220
add esp, 0xc
push 0x104
lea edx, [ebp - 0x224]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x18], 0
call fcn.00405010
test eax, eax
jne 0x4162d7
mov dword [ebp - 0x18], 0x42e818
push 5
push 0
push str._uninstalldrive
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push 2
push 0x111
mov ecx, dword [ebp - 0x22c]
add ecx, 4
call fcn.0040adf0
mov dword [ebp - 0x228], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00403df0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00403df0
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0041c203
mov esp, ebp
pop ebp
ret 0x10
Function at 0x417b00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ca5b
mov eax, dword fs:[0]
push eax
sub esp, 0x84c
mov eax, dword [0x436a98]
xor eax, ebp
mov dword [ebp - 0x28], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov word [ebp - 0x82c], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x82a]
push ecx
call fcn.0041c220
add esp, 0xc
push str.Update
push 0x42ea18
push 0x42ea28
push str.software_s_s_s
lea edx, [ebp - 0x82c]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea ecx, [ebp - 0x830]
call fcn.0042b880
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x830]
call fcn.0042b850
push eax
push 0x20019
push 0
lea eax, [ebp - 0x82c]
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x417bd5
mov dword [ebp - 0x854], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x830]
call fcn.0042b860
mov eax, dword [ebp - 0x854]
jmp 0x417c7a
mov dword [ebp - 0x838], 0
xor ecx, ecx
mov dword [ebp - 0x834], ecx
mov dword [ebp - 0x850], 8
lea edx, [ebp - 0x850]
push edx
lea eax, [ebp - 0x838]
push eax
lea ecx, [ebp - 0x20]
push ecx
push 0
push str.kernel
lea ecx, [ebp - 0x830]
call fcn.0042b840
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x838]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea ecx, [ebp - 0x848]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea edx, [ebp - 0x848]
push edx
lea eax, [ebp - 0x1c]
push eax
call fcn.00417ab0
add esp, 8
mov dword [ebp - 0x84c], eax
mov ecx, dword [ebp - 0x84c]
mov dword [ebp - 0x858], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x830]
call fcn.0042b860
mov eax, dword [ebp - 0x858]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.0041c203
mov esp, ebp
pop ebp
ret

Function at 0x4181a0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
cmp dword [ebp - 0xc], 3
jne 0x4181f1
mov dword [ebp - 8], 1
push 0x42eac0
mov ecx, dword [ebp + 8]
call fcn.004185f0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
mov ecx, dword [ebp + 8]
call fcn.004185f0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x418210
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42cb52
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x436a98]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00417b00
test eax, eax
jne 0x41824e
mov eax, 1
jmp 0x418354
call fcn.00418060
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x258], 0x3c
push 0x38
push 0
lea eax, [ebp - 0x254]
push eax
call fcn.0041c220
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x21c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 0x260], eax
push 0x42eac4
mov eax, dword [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x248], ecx
lea ecx, [ebp - 0x25c]
call fcn.00403fe0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x10]
push edx
push 0x42eae8
push 0x42eaf0
lea eax, [ebp - 0x25c]
push eax
call fcn.00404000
add esp, 0x10
lea ecx, [ebp - 0x25c]
call fcn.00418500
mov dword [ebp - 0x244], eax
lea ecx, [ebp - 0x25c]
push ecx
call fcn.004181a0
add esp, 4
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x254], 0x400
lea edx, [ebp - 0x258]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x418333
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x264], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x25c]
call fcn.00404a50
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041c203
mov esp, ebp
pop ebp
ret
Function at 0x418760
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42cbc0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x436a98]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
push 0x42eb14
push 1
push 1
lea ecx, [ebp - 0x14]
call fcn.00418400
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 4
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x24]
add ecx, 0x5c
push ecx
lea edx, [ebp - 0x10]
push edx
push 0
push 0x42eb20
lea ecx, [ebp - 0x14]
call fcn.00418500
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x42eb34
push 1
push 1
lea ecx, [ebp - 0x18]
call fcn.00418400
mov byte [ebp - 4], 1
mov dword [ebp - 0x1c], 4
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x24]
add ecx, 0x60
push ecx
lea edx, [ebp - 0x10]
push edx
push 0
push 0x42eb54
lea ecx, [ebp - 0x18]
call fcn.00418500
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x1c], 4
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x24]
add ecx, 0x58
push ecx
lea edx, [ebp - 0x10]
push edx
push 0
push 0x42eb68
lea ecx, [ebp - 0x18]
call fcn.00418500
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0xffffffffffffffff
push 0
mov ecx, dword [ebp - 0x24]
call fcn.00418a80
mov dword [ebp - 0x20], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.004184e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004184e0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x418880
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42cbeb
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x436a98]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
push 0xffffffffffffffff
push 1
mov ecx, dword [ebp - 0x1c]
call fcn.00418a80
push str.Mount
push 3
push 0
lea ecx, [ebp - 0x10]
call fcn.00418400
mov dword [ebp - 4], 0
push 4
mov eax, dword [ebp - 0x1c]
add eax, 0x5c
push eax
push 4
push 0
push str.OpenDrive
lea ecx, [ebp - 0x10]
call fcn.00418500
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push str.MountMenuItems
push 3
push 0
lea ecx, [ebp - 0x14]
call fcn.00418400
mov byte [ebp - 4], 1
push 4
mov ecx, dword [ebp - 0x1c]
add ecx, 0x60
push ecx
push 4
push 0
push str.Casscade
lea ecx, [ebp - 0x14]
call fcn.00418500
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
mov edx, dword [ebp - 0x1c]
add edx, 0x58
push edx
push 4
push 0
push str.IntegrateExplorer
lea ecx, [ebp - 0x14]
call fcn.00418500
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x18], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004184e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004184e0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret