joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b1ec0
Capabilities:
Persist via default file association registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x298
push ebp
lea eax, [esp + 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0x20006
push 0
push 0
push closesocket
mov dword [esp + 0x1c], 0
call esi
test eax, eax
jne 0x4b1f04
lea ecx, [esp + 8]
push ecx
push str.batfile_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 8]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebp
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str.batfile_shellopencommand
push closesocket
call esi
test eax, eax
je 0x4b1f39
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x298
ret
lea ecx, [esp + 0x1c]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0xa4]
push ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x20]
xor esi, esi
push edx
push eax
push esi
push esi
push ecx
mov dword [esp + 0x38], 0x100
mov dword [esp + 0x34], 1
call edi
lea edx, [esp + 0x20]
lea eax, [esp + 0xa4]
push edx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
push ecx
push esi
push esi
push edx
call edi
test eax, eax
jne 0x4b2037
lea eax, [esp + 0xa4]
lea ecx, [esp + 0x24]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [esp + 0x30]
push 0x5287b8
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
je 0x4b1fd3
lea eax, [esp + 0x24]
push 0x5287b4
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4b1fd8
mov esi, 1
lea ecx, [esp + 0x24]
push 0x50dc3c
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4b1ff3
mov esi, 1
lea edx, [esp + 0x10]
lea eax, [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x1ac]
push str._s_1_s__
push ecx
mov byte [esp + 0x20], 0x22
mov byte [esp + 0x21], 0
call fcn.004f175f
lea edx, [esp + 0x34]
lea eax, [esp + 0x1b4]
push edx
push eax
call fcn.004f61e0
add esp, 0x18
test eax, eax
jne 0x4b2037
cmp esi, 1
jne 0x4b208a
lea ecx, [esp + 0x10]
mov al, 0x25
push ecx
mov byte [esp + 0x14], 0x22
mov byte [esp + 0x15], al
mov byte [esp + 0x16], 0x31
mov byte [esp + 0x17], 0x22
mov byte [esp + 0x18], 0x20
mov byte [esp + 0x19], al
mov byte [esp + 0x1a], 0x2a
mov byte [esp + 0x1b], 0
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x14]
push 1
push eax
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0xc]
push eax
call ebp
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x298
ret
Function at 0x4b20a0
Capabilities:
Persist via default file association registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x298
push ebp
lea eax, [esp + 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0x20006
push 0
push 0
push closesocket
mov dword [esp + 0x1c], 0
call esi
test eax, eax
jne 0x4b20e4
lea ecx, [esp + 8]
push ecx
push str.comfile_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 8]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebp
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str.comfile_shellopencommand
push closesocket
call esi
test eax, eax
je 0x4b2119
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x298
ret
lea ecx, [esp + 0x1c]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0xa4]
push ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x20]
xor esi, esi
push edx
push eax
push esi
push esi
push ecx
mov dword [esp + 0x38], 0x100
mov dword [esp + 0x34], 1
call edi
lea edx, [esp + 0x20]
lea eax, [esp + 0xa4]
push edx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
push ecx
push esi
push esi
push edx
call edi
test eax, eax
jne 0x4b2217
lea eax, [esp + 0xa4]
lea ecx, [esp + 0x24]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [esp + 0x30]
push 0x5287b8
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
je 0x4b21b3
lea eax, [esp + 0x24]
push 0x5287b4
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4b21b8
mov esi, 1
lea ecx, [esp + 0x24]
push 0x50dc3c
push ecx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4b21d3
mov esi, 1
lea edx, [esp + 0x10]
lea eax, [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x1ac]
push str._s_1_s__
push ecx
mov byte [esp + 0x20], 0x22
mov byte [esp + 0x21], 0
call fcn.004f175f
lea edx, [esp + 0x34]
lea eax, [esp + 0x1b4]
push edx
push eax
call fcn.004f61e0
add esp, 0x18
test eax, eax
jne 0x4b2217
cmp esi, 1
jne 0x4b226a
lea ecx, [esp + 0x10]
mov al, 0x25
push ecx
mov byte [esp + 0x14], 0x22
mov byte [esp + 0x15], al
mov byte [esp + 0x16], 0x31
mov byte [esp + 0x17], 0x22
mov byte [esp + 0x18], 0x20
mov byte [esp + 0x19], al
mov byte [esp + 0x1a], 0x2a
mov byte [esp + 0x1b], 0
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x14]
push 1
push eax
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0xc]
push eax
call ebp
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x298
ret
Function at 0x4b2280
Capabilities:
Get common file path
Persist via default file association registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x314
push ebp
lea eax, [esp + 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0x20006
push 0
push 0
push closesocket
mov dword [esp + 0x1c], 0
call esi
test eax, eax
jne 0x4b22c4
lea ecx, [esp + 8]
push ecx
push str.regfile_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 8]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebp
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str.regfile_shellopencommand
push closesocket
call esi
test eax, eax
je 0x4b22f9
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x314
ret
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x11c]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push 0
push ecx
mov dword [esp + 0x30], 0x100
mov dword [esp + 0x2c], 1
call esi
lea edx, [esp + 0x18]
lea eax, [esp + 0x11c]
push edx
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push 0
push edx
call esi
test eax, eax
jne 0x4b2390
lea eax, [esp + 0x11c]
lea ecx, [esp + 0x1c]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [esp + 0x28]
push 0x5287b8
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
je 0x4b2390
lea eax, [esp + 0x1c]
push str.regedit.exe
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4b2405
push edi
lea ecx, [esp + 0x20]
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov al, 0x22
lea edx, [esp + 0x10]
mov byte [esp + 0x10], al
mov byte [esp + 0x13], al
lea eax, [esp + 0x20]
push edx
push eax
lea ecx, [esp + 0x228]
push str._s_regedit.exe__s
push ecx
mov byte [esp + 0x21], 0x25
mov byte [esp + 0x22], 0x31
mov byte [esp + 0x24], 0
call fcn.004f175f
lea edx, [esp + 0x230]
push edx
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
push eax
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
mov ecx, dword [esp + 8]
push ecx
call ebp
pop esi
mov eax, 1
pop ebp
add esp, 0x314
ret
Function at 0x4b2420
Capabilities:
Get common file path
Persist via default file association registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x314
push ebp
lea eax, [esp + 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0x20006
push 0
push 0
push closesocket
mov dword [esp + 0x1c], 0
call esi
test eax, eax
jne 0x4b2464
lea ecx, [esp + 8]
push ecx
push str.regedit_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 8]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebp
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str.regedit_shellopencommand
push closesocket
call esi
test eax, eax
je 0x4b2499
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x314
ret
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x11c]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push 0
push ecx
mov dword [esp + 0x30], 0x100
mov dword [esp + 0x2c], 1
call esi
lea edx, [esp + 0x18]
lea eax, [esp + 0x11c]
push edx
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push 0
push edx
call esi
test eax, eax
jne 0x4b2530
lea eax, [esp + 0x11c]
lea ecx, [esp + 0x1c]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [esp + 0x28]
push 0x5287b8
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
je 0x4b2530
lea eax, [esp + 0x1c]
push str.regedit.exe
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4b25af
push edi
lea ecx, [esp + 0x220]
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov al, 0x22
lea edx, [esp + 0x10]
mov byte [esp + 0x10], al
mov byte [esp + 0x13], al
lea eax, [esp + 0x220]
push edx
push eax
lea ecx, [esp + 0x28]
push str._s_regedit.exe__s
push ecx
mov byte [esp + 0x21], 0x25
mov byte [esp + 0x22], 0x31
mov byte [esp + 0x24], 0
call fcn.004f175f
lea edx, [esp + 0x30]
push edx
call fcn.004fa6c0
lea eax, [esp + 0x34]
push eax
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x10]
push edx
push 1
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
mov edx, dword [esp + 8]
push edx
call ebp
pop esi
mov eax, 1
pop ebp
add esp, 0x314
ret
Function at 0x4b25d0
Capabilities:
Persist via default file association registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x20c
push ebx
lea eax, [esp + 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0x20006
push 0
push 0
push closesocket
mov dword [esp + 0x1c], 0
call esi
test eax, eax
jne 0x4b2614
lea ecx, [esp + 8]
push ecx
push str.hlpfile_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebx
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str.helpfile_shellopencommand
push closesocket
call esi
test eax, eax
je 0x4b2649
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x20c
ret
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x114]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ecx
mov dword [esp + 0x28], 0x100
mov dword [esp + 0x24], 1
call esi
lea edx, [esp + 0x10]
lea eax, [esp + 0x114]
push edx
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
push 0
push edx
call esi
test eax, eax
jne 0x4b26e0
lea eax, [esp + 0x114]
lea ecx, [esp + 0x14]
push eax
push 0x50d39c
push ecx
call fcn.004f175f
lea edx, [esp + 0x20]
push 0x5287b8
push edx
call fcn.004f2d80
add esp, 0x14
test eax, eax
je 0x4b26e0
lea eax, [esp + 0x14]
push str.winhlp.exe
push eax
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4b2721
push edi
push 0x5287b8
lea ecx, [esp + 0x1c]
push str.winhlp32.exe__s
push ecx
call fcn.004f175f
lea edx, [esp + 0x24]
push edx
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
push eax
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
mov ecx, dword [esp + 8]
push ecx
call ebx
pop esi
mov eax, 1
pop ebx
add esp, 0x20c
ret
Function at 0x4b2740
Capabilities:
Get common file path
Persist via default file association registry key
Set registry value

Disassembly:
sub esp, 0x204
push esi
lea eax, [esp + 4]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0x20006
push 0
push 0
push closesocket
mov dword [esp + 0x1c], 0
call edi
test eax, eax
jne 0x4b2784
lea ecx, [esp + 8]
push ecx
push str.Drive_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str.Drive_shellopencommand
push closesocket
call edi
test eax, eax
je 0x4b27b9
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x204
ret
lea ecx, [esp + 0xc]
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0xc]
lea eax, [esp + 0x10c]
push edx
push str._sexplorer.exe
push eax
call fcn.004f175f
lea ecx, [esp + 0x118]
push ecx
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x10]
push 1
push eax
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 8]
push eax
call esi
pop edi
mov eax, 1
pop esi
add esp, 0x204
ret

Function at 0x4b2830
Capabilities:
Get common file path
Persist via default file association registry key
Set registry value

Disassembly:
sub esp, 0x204
push esi
lea eax, [esp + 4]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0x20006
push 0
push 0
push closesocket
mov dword [esp + 0x1c], 0
call edi
test eax, eax
jne 0x4b2874
lea ecx, [esp + 8]
push ecx
push str.wrifile_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str.wrifile_shellopencommand
push closesocket
call edi
test eax, eax
je 0x4b28a9
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x204
ret
lea ecx, [esp + 0xc]
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x5287b8
lea edx, [esp + 0x10]
push str.Program_FilesWindows_NTAccessoriesWORDPAD.EXE
push edx
lea eax, [esp + 0x118]
push str._s_s__s
push eax
mov byte [esp + 0x23], 0
call fcn.004f175f
lea ecx, [esp + 0x120]
push ecx
call fcn.004fa6c0
lea edx, [esp + 0x124]
push edx
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0x1c
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
push eax
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 8]
push ecx
call esi
pop edi
mov eax, 1
pop esi
add esp, 0x204
ret
Function at 0x4b2930
Capabilities:
Get common file path
Persist via default file association registry key
Set registry value

Disassembly:
sub esp, 0x304
push esi
lea eax, [esp + 4]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0x20006
push 0
push 0
push closesocket
mov dword [esp + 0x1c], 0
call edi
test eax, eax
jne 0x4b2974
lea ecx, [esp + 8]
push ecx
push str.txtfile_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str.txtfile_shellopencommand
push closesocket
call edi
test eax, eax
je 0x4b29a9
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x304
ret
lea ecx, [esp + 0x20c]
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x10c]
push 0x100
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x10c]
push 0x5287b8
push eax
lea ecx, [esp + 0x14]
push str._s_notepad.exe__s
push ecx
call fcn.004f175f
lea edx, [esp + 0x1c]
push edx
call fcn.004fa6c0
lea eax, [esp + 0x20]
push eax
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 1
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 8]
push edx
call esi
pop edi
mov eax, 1
pop esi
add esp, 0x304
ret
Function at 0x4b2a40
Capabilities:
Get common file path
Persist via default file association registry key
Set registry value

Disassembly:
sub esp, 0x210
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push 0x20006
push 0
push 0
push closesocket
mov dword [esp + 0x24], 0
call ebx
test eax, eax
jne 0x4b2a86
lea ecx, [esp + 0x10]
push ecx
push str.cplfile_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebp
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push str.cplfile_shellopencommand
push closesocket
call ebx
test eax, eax
je 0x4b2abd
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x210
ret
lea ecx, [esp + 0x120]
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov al, 0x25
lea edx, [esp + 0x14]
mov byte [esp + 0x15], al
mov byte [esp + 0x19], al
push edx
lea eax, [esp + 0x24]
mov cl, 0x22
push str.rundll32.exe_shell32.dll_Control_RunDLL__s
push eax
mov byte [esp + 0x20], cl
mov byte [esp + 0x22], 0x31
mov byte [esp + 0x23], cl
mov byte [esp + 0x24], 0x20
mov byte [esp + 0x26], 0x2a
mov byte [esp + 0x27], 0
call fcn.004f175f
lea ecx, [esp + 0x2c]
push ecx
call fcn.004fa6c0
mov esi, eax
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
add esp, 0x10
mov edx, dword [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
push ecx
push esi
push 1
push eax
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push 0
push str.cplfile_shellcplopencommand
push closesocket
call ebx
test eax, eax
je 0x4b2b68
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x210
ret
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
push ecx
push esi
push 1
push eax
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
push eax
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x210
ret
Function at 0x4b2ba0
Capabilities:
Get common file path
Persist via default file association registry key
Set registry value

Disassembly:
sub esp, 0x210
push esi
lea eax, [esp + 4]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0x20006
push 0
push 0
push closesocket
mov dword [esp + 0x1c], 0
call edi
test eax, eax
jne 0x4b2be4
lea ecx, [esp + 8]
push ecx
push str.htafile_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str.htafile_shellopencommand
push closesocket
call edi
test eax, eax
je 0x4b2c19
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x210
ret
lea ecx, [esp + 0x18]
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov al, 0x25
mov cl, 0x22
mov byte [esp + 0xd], al
mov byte [esp + 0x11], al
lea edx, [esp + 0xc]
lea eax, [esp + 0x18]
mov byte [esp + 0xc], cl
mov byte [esp + 0xf], cl
push edx
push eax
lea ecx, [esp + 0x120]
push str._smshta.exe__s
push ecx
mov byte [esp + 0x1e], 0x31
mov byte [esp + 0x20], 0x20
mov byte [esp + 0x22], 0x2a
mov byte [esp + 0x23], 0
call fcn.004f175f
lea edx, [esp + 0x128]
push edx
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
push eax
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 8]
push ecx
call esi
pop edi
mov eax, 1
pop esi
add esp, 0x210
ret
Function at 0x4b2cb0
Capabilities:
Get common file path
Persist via default file association registry key
Set registry value

Disassembly:
sub esp, 0x310
push esi
lea eax, [esp + 4]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0x20006
push 0
push 0
push closesocket
mov dword [esp + 0x1c], 0
call edi
test eax, eax
jne 0x4b2cf4
lea ecx, [esp + 8]
push ecx
push str.rtffile_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str.rtffile_shellopencommand
push closesocket
call edi
test eax, eax
je 0x4b2d29
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x310
ret
lea ecx, [esp + 0x218]
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x18]
push 0x100
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov al, 0x22
lea ecx, [esp + 0x18]
mov byte [esp + 0xc], al
mov byte [esp + 0xf], al
lea eax, [esp + 0xc]
lea edx, [esp + 0x118]
push eax
push ecx
push str._sProgram_FilesWindows_NTAccessoriesWORDPAD.EXE__s
push edx
mov byte [esp + 0x2a], 0
mov byte [esp + 0x1d], 0x25
mov byte [esp + 0x1e], 0x31
mov byte [esp + 0x20], 0
call fcn.004f175f
lea eax, [esp + 0x128]
push eax
call fcn.004fa6c0
lea ecx, [esp + 0x12c]
push ecx
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x10]
push 1
push eax
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 8]
push eax
call esi
pop edi
mov eax, 1
pop esi
add esp, 0x310
ret
Function at 0x4b2de0
Capabilities:
Get common file path
Persist via default file association registry key
Set registry value

Disassembly:
sub esp, 0x304
push esi
lea eax, [esp + 4]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0x20006
push 0
push 0
push closesocket
mov dword [esp + 0x1c], 0
call edi
test eax, eax
jne 0x4b2e24
lea ecx, [esp + 8]
push ecx
push str.inffile_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str.inffile_shellopencommand
push closesocket
call edi
test eax, eax
je 0x4b2e59
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x304
ret
lea ecx, [esp + 0x20c]
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x10c]
push 0x100
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x10c]
push 0x5287b8
push eax
lea ecx, [esp + 0x14]
push str._s_notepad.exe__s
push ecx
call fcn.004f175f
lea edx, [esp + 0x1c]
push edx
call fcn.004fa6c0
lea eax, [esp + 0x20]
push eax
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 1
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 8]
push edx
call esi
pop edi
mov eax, 1
pop esi
add esp, 0x304
ret

Function at 0x4b2ef0
Capabilities:
Get common file path
Persist via default file association registry key
Set registry value

Disassembly:
sub esp, 0x304
lea eax, [esp]
mov dword [esp], 0
push eax
push 2
push 0
push str.hlpfile_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4b2f25
or eax, 0xffffffff
add esp, 0x304
ret
push edi
lea ecx, [esp + 0x208]
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x108]
push 0x100
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x108]
push 0x5287b8
push eax
lea ecx, [esp + 0x10]
push str._sSystem32winhlp32.exe__s
push ecx
call fcn.004f175f
lea edx, [esp + 0x18]
push edx
call fcn.004fa6c0
lea eax, [esp + 0x1c]
push eax
call fcn.004fa6c0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 8]
push edx
push 1
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
add esp, 0x304
ret