joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e4b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x620], 0
push esi
push edi
xor eax, eax
mov edi, 0x206
push edi
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov esi, ecx
call fcn.00537010
add esp, 0xc
cmp dword [esi + 0xa8], 8
jb 0x44e4fe
mov eax, dword [esi + 0x94]
jmp 0x44e504
lea eax, [esi + 0x94]
push ebx
push eax
push 0x57cb68
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.00532a01
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea ebx, [ebp - 0x20c]
call fcn.0049699b
xor eax, eax
push edi
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.00537010
add esp, 0xc
cmp dword [esi + 0xa8], 8
jb 0x44e562
mov eax, dword [esi + 0x94]
jmp 0x44e568
lea eax, [esi + 0x94]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x583ed0
push eax
lea eax, [ebp - 0x414]
push eax
call ebx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x44e5b5
cmp dword [esi + 0x54], 8
jb 0x44e599
mov eax, dword [esi + 0x40]
jmp 0x44e59c
lea eax, [esi + 0x40]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.00499c6c
pop ecx
pop ecx
mov dword [ebp - 0x620], 1
xor eax, eax
push edi
push eax
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push eax
call fcn.00537010
lea eax, [esi + 0xac]
add esp, 0xc
cmp dword [eax + 0x18], 8
jb 0x44e5e0
mov eax, dword [eax + 4]
jmp 0x44e5e3
add eax, 4
push 0x583ed0
push eax
lea eax, [ebp - 0x61c]
push eax
call ebx
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop ebx
test eax, eax
jne 0x44e62b
cmp dword [esi + 0x54], 8
jb 0x44e60f
mov esi, dword [esi + 0x40]
jmp 0x44e612
add esi, 0x40
lea eax, [ebp - 0x61c]
push esi
push eax
call fcn.00499c6c
pop ecx
pop ecx
mov dword [ebp - 0x620], 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x620]
pop edi
xor ecx, ebp
pop esi
call fcn.0052f7d0
leave
ret

Function at 0x44e650
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
cmp word [edi], si
je 0x44e6d1
cmp dword [0x5d787c], esi
jne 0x44e6d1
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.00537010
add esp, 0xc
push esi
push 0x28
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x44e6ab
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.005330a4
add esp, 0xc
neg eax
sbb eax, eax
inc eax
jmp 0x44e6d4
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0052f7d0
leave
ret
Function at 0x44e8bc
Capabilities:
Enumerate files on windows

Disassembly:
push 0x690
mov eax, 0x563251
call fcn.00539a44
mov eax, dword [ebp + 8]
mov dword [ebp - 0x67c], eax
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x21c], ax
xor ebx, ebx
lea eax, [ebp - 0x21a]
mov esi, ecx
push ebx
push eax
mov dword [ebp - 0x680], esi
call fcn.00537010
add esp, 0xc
push str..lnk
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x21c]
push eax
call esi
push 0x24c
lea eax, [ebp - 0x670]
push ebx
push eax
mov dword [ebp - 0x674], ebx
call fcn.00537010
add esp, 0xc
lea eax, [ebp - 0x674]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x678], eax
cmp eax, 0xffffffff
je 0x44ea1b
lea eax, [ebp - 0x648]
push 0x583f04
push eax
call fcn.005320ad
pop ecx
pop ecx
test eax, eax
je 0x44e9f4
lea eax, [ebp - 0x648]
push 0x583f08
push eax
call fcn.005320ad
pop ecx
pop ecx
test eax, eax
je 0x44e9f4
xor eax, eax
push edi
mov word [ebp - 0x424], ax
lea eax, [ebp - 0x422]
push ebx
push eax
call fcn.00537010
add esp, 0xc
lea eax, [ebp - 0x648]
push eax
push dword [ebp - 0x680]
lea eax, [ebp - 0x424]
push eax
call esi
test byte [ebp - 0x674], 0x10
jne 0x44e9f4
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x69c]
call fcn.0040a8b0
mov ecx, dword [ebp - 0x67c]
lea eax, [ebp - 0x69c]
push eax
mov dword [ebp - 4], ebx
call fcn.00406326
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x69c]
call fcn.004053e5
lea eax, [ebp - 0x674]
push eax
push dword [ebp - 0x678]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x44e950
push dword [ebp - 0x678]
call dword [sym.imp.KERNEL32.dll_FindClose]
call fcn.00539ac7
ret 4
Function at 0x44ec06
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push 8
mov eax, 0x5645f9
call fcn.005399db
mov eax, dword [ebp + 8]
call fcn.0045488e
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x44ed08
push 0xd
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x44ed02
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x44ecf9
cmp word [eax], 0
mov ebx, eax
je 0x44ecf9
cmp word [eax], 0
je 0x44ecbd
movzx ecx, word [ebx]
cmp cx, 0xd
je 0x44ec75
cmp cx, 0xa
jne 0x44ecb5
cmp ebx, eax
jbe 0x44ecb2
mov edi, ebx
sub edi, eax
sar edi, 1
push eax
mov ecx, 0x5beb28
lea esi, [ebp - 0x10]
call fcn.0041679e
and dword [ebp - 4], 0
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
je 0x44eca6
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
call fcn.00425ce4
or dword [ebp - 4], 0xffffffff
lea eax, [esi - 0x10]
call fcn.00407d09
lea eax, [ebx + 2]
inc ebx
inc ebx
cmp word [ebx], 0
jne 0x44ec60
cmp ebx, eax
jbe 0x44ecf9
mov edi, ebx
sub edi, eax
sar edi, 1
push eax
mov ecx, 0x5beb28
lea esi, [ebp - 0x10]
call fcn.0041679e
mov dword [ebp - 4], 1
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
je 0x44ecf1
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
call fcn.00425ce4
lea eax, [esi - 0x10]
call fcn.00407d09
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
call fcn.00539ab3
ret
Function at 0x45079c
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, 0xa000
push edi
mov dword [ebp - 4], edi
call fcn.0052f69b
mov esi, eax
pop ecx
test esi, esi
je 0x450866
push edi
push 0
push esi
call fcn.00537010
mov eax, dword [ebp - 4]
add esp, 0xc
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
push esi
push str.visited:
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
mov dword [ebp - 8], eax
test eax, eax
je 0x45085f
mov ecx, dword [ebp + 8]
call fcn.0045070d
mov ebx, dword [sym.imp.WININET.dll_DeleteUrlCacheEntryA]
mov dword [ebp - 0xc], eax
push dword [esi + 0x34]
push dword [esi + 0x30]
push dword [ebp - 0xc]
call fcn.00450737
add esp, 0xc
test eax, eax
je 0x450830
push dword [esi + 4]
call ebx
test eax, eax
jne 0x450830
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x450830
push 0
push dword [esi + 4]
call dword [sym.imp.WININET.dll_UnlockUrlCacheEntryFileA]
push dword [esi + 4]
call ebx
push edi
push 0
push esi
mov dword [ebp - 4], edi
call fcn.00537010
mov eax, dword [ebp - 4]
add esp, 0xc
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp - 8]
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
test eax, eax
jne 0x4507f7
push dword [ebp - 8]
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
push esi
call fcn.0052f7c5
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x45086b
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
xor eax, eax
push 0x206
mov word [ebp - 0x214], ax
xor edi, edi
lea eax, [ebp - 0x212]
push edi
push eax
call fcn.00537010
add esp, 0xc
push edi
push 0x57cb68
lea eax, [ebp - 0x214]
push 0x103
push eax
call fcn.00532a01
add esp, 0x10
cmp dword [ebp + 8], edi
jne 0x4508f6
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.004352dc
mov esi, eax
cmp esi, edi
je 0x4508dd
mov eax, dword [esi]
push esi
call dword [eax + 0x24]
mov eax, dword [esi]
push esi
call dword [eax + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
call fcn.0043554c
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45091d
push edi
jmp 0x450918
push dword [ebp + 8]
call fcn.0045079c
pop ecx
call fcn.0043554c
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45091d
mov ecx, dword [ebp + 8]
call fcn.0045070d
push eax
call fcn.004360aa
call fcn.0044a269
mov esi, eax
call fcn.0044aeeb
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
xor ecx, ebp
inc eax
pop esi
call fcn.0052f7d0
leave
ret
Function at 0x45093a
Capabilities:
Delete directory
Delete internet cache
Enumerate internet cache
Get common file path

Disassembly:
push 0x840
push 0x5a4e08
call fcn.0055a19c
mov edi, 0xa000
mov dword [ebp - 0x848], edi
call fcn.0045070d
mov dword [ebp - 0x850], eax
push edi
call fcn.0052f69b
pop ecx
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x450b86
push edi
push ebx
push esi
call fcn.00537010
add esp, 0xc
mov eax, dword [ebp - 0x848]
mov dword [esi], eax
lea eax, [ebp - 0x848]
push eax
push esi
push str.cookie:
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
mov dword [ebp - 0x84c], eax
cmp eax, ebx
je 0x450a26
push dword [esi + 0x34]
push dword [esi + 0x30]
push dword [ebp - 0x850]
call fcn.00450737
add esp, 0xc
test eax, eax
je 0x4509e9
push dword [esi + 4]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryA]
test eax, eax
jne 0x4509e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4509e9
push ebx
push dword [esi + 4]
call dword [sym.imp.WININET.dll_UnlockUrlCacheEntryFileA]
push dword [esi + 4]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryA]
mov dword [ebp - 0x848], edi
push edi
push ebx
push esi
call fcn.00537010
add esp, 0xc
mov eax, dword [ebp - 0x848]
mov dword [esi], eax
lea eax, [ebp - 0x848]
push eax
push esi
push dword [ebp - 0x84c]
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
test eax, eax
jne 0x4509a6
push dword [ebp - 0x84c]
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
push esi
call fcn.0052f7c5
pop ecx
cmp dword [ebp - 0x850], ebx
jne 0x450b86
xor eax, eax
mov word [ebp - 0x844], ax
mov esi, 0x206
push esi
push ebx
lea eax, [ebp - 0x842]
push eax
call fcn.00537010
add esp, 0xc
mov edi, 0x577458
push ebx
push 0x21
lea eax, [ebp - 0x844]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x450a78
lea edi, [ebp - 0x844]
cmp edi, ebx
je 0x450aeb
cmp word [edi], bx
je 0x450aeb
xor eax, eax
mov word [ebp - 0x63c], ax
push esi
push ebx
lea eax, [ebp - 0x63a]
push eax
call fcn.00537010
add esp, 0xc
push str._.txt
push edi
push 0x57c6a4
push 0x103
lea eax, [ebp - 0x63c]
push eax
call fcn.00532a01
add esp, 0x14
mov dword [ebp - 4], ebx
lea edx, [ebp - 0x63c]
call fcn.00497329
mov dword [ebp - 4], 0xfffffffe
jmp 0x450aeb
xor eax, eax
mov word [ebp - 0x434], ax
push esi
push ebx
lea eax, [ebp - 0x432]
push eax
call fcn.00537010
add esp, 0xc
xor eax, eax
mov word [ebp - 0x22c], ax
push esi
push ebx
lea eax, [ebp - 0x22a]
push eax
call fcn.00537010
add esp, 0xc
push 0x5d824c
push str._sUserCache_
mov esi, 0x103
push esi
lea eax, [ebp - 0x434]
push eax
call fcn.00532a01
push str.Cookies
lea eax, [ebp - 0x434]
push eax
push 0x58409c
push esi
lea eax, [ebp - 0x22c]
push eax
call fcn.00532a01
add esp, 0x24
xor eax, eax
cmp ax, word [ebp - 0x22c]
je 0x450b86
push ebx
push ebx
push ebx
lea eax, [ebp - 0x22c]
push eax
call fcn.004a442e
add esp, 0x10
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
call fcn.0055a1e4
ret
Function at 0x450b8c
Capabilities:
Delete file
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, 0xa000
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
mov dword [ebp - 4], edi
neg ecx
or ecx, eax
push ecx
call fcn.0052f69b
mov esi, eax
pop ecx
test esi, esi
je 0x450c76
mov ebx, 0x14000
push ebx
push 0
push esi
call fcn.00537010
mov eax, dword [ebp - 4]
add esp, 0xc
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
push esi
push 0
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryW]
mov dword [ebp - 8], eax
test eax, eax
je 0x450c6f
mov ecx, dword [ebp + 8]
call fcn.0045070d
mov dword [ebp - 0xc], eax
test dword [esi + 0xc], 0x100008
jne 0x450c43
push dword [esi + 0x34]
push dword [esi + 0x30]
push dword [ebp - 0xc]
call fcn.00450737
add esp, 0xc
test eax, eax
je 0x450c43
push dword [esi + 4]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
test eax, eax
jne 0x450c35
push eax
push dword [esi + 4]
call dword [sym.imp.WININET.dll_UnlockUrlCacheEntryFileW]
push dword [esi + 4]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
mov eax, dword [esi + 8]
test eax, eax
je 0x450c43
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push 0
push esi
call fcn.00537010
add esp, 0xc
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp - 8]
mov dword [ebp - 4], edi
mov dword [esi], edi
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryW]
test eax, eax
jne 0x450bf7
push dword [ebp - 8]
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
push esi
call fcn.0052f7c5
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x450f70
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebx
mov ebx, dword [0x64a66c]
test bl, 1
je 0x450f84
push 0
call fcn.00450b8c
pop ecx
test bl, 2
je 0x450f91
push 0
call fcn.0045086b
pop ecx
test bl, 4
je 0x450f9d
xor ecx, ecx
call fcn.0045093a
test bl, 8
je 0x450fb2
push str.SoftwareMicrosoftInternet_ExplorerTypedURLs
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test bl, 0x10
je 0x450fbd
pop ebx
jmp fcn.00450c7b
pop ebx
ret

Function at 0x450fbf
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov bl, byte [ebp + 0xc]
push esi
xor esi, esi
push edi
mov dword [esp + 0xc], esi
cmp dword [0x5d7884], esi
je 0x451013
lea eax, [esp + 0xc]
push eax
push 0x584238
push 1
push esi
push 0x573440
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x451013
mov eax, dword [esp + 0xc]
cmp eax, esi
je 0x451013
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push 1
push dword [ebp + 8]
push eax
call dword [ecx + 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
pop edi
test bl, 1
je 0x45102d
push dword [ebp + 0x10]
call fcn.00450b8c
pop ecx
push edi
call esi
test bl, 2
je 0x45103e
push dword [ebp + 0x10]
call fcn.0045086b
pop ecx
push edi
call esi
test bl, 4
je 0x45104e
mov ecx, dword [ebp + 0x10]
call fcn.0045093a
push edi
call esi
test bl, 8
je 0x451066
push str.SoftwareMicrosoftInternet_ExplorerTypedURLs
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push edi
call esi
test bl, 0x10
je 0x451073
call fcn.00450c7b
push edi
call esi
test bl, bl
jns 0x45107a
push edi
call esi
push 0x12c
call esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4510a0
push 0
push 0
push 0x8c84
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4533b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [esi + 0x38], edi
jne 0x4533fa
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push edi
push 1
push edi
call ebx
push edi
push edi
push 1
push edi
mov dword [esi + 0x24], eax
call ebx
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x34]
push eax
push edi
push esi
push 0x45354f
push edi
push edi
call fcn.0053364a
add esp, 0x18
mov dword [esi + 0x30], eax
mov dword [esi + 0x38], 1
pop ebx
cmp dword [esi + 0x28], edi
jne 0x45342e
cmp dword [esi + 0x30], edi
je 0x453429
push 0x3e8
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x453429
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], 1
cmp dword [esi + 0x28], edi
je 0x45346a
cmp dword [esi + 0x34], edi
je 0x45346a
push 8
call fcn.0052fe0a
pop ecx
cmp eax, edi
je 0x45344a
mov dword [eax], 3
mov dword [eax + 4], edi
jmp 0x45344c
xor eax, eax
mov ecx, dword [ebp + 8]
push edi
mov dword [eax], ecx
mov ecx, dword [ebp + 0xc]
push eax
push 0x7e9
mov dword [eax + 4], ecx
push dword [esi + 0x34]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
leave
ret 8

Function at 0x453472
Capabilities:
Suspend thread
Terminate thread

Disassembly:
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x453480
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x30]
test eax, eax
je 0x4534b8
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4534ab
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0xffffffffffffffff
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 0x30], 0
ret
Function at 0x453d42
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20b4
call fcn.005482e0
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
xor eax, eax
push edi
test ebx, ebx
je 0x453eea
mov esi, 0x1046
push esi
push eax
mov word [ebp - 0x1060], ax
lea eax, [ebp - 0x105e]
push eax
call fcn.00537010
add esp, 0xc
xor eax, eax
push esi
push eax
mov word [ebp - 0x20a8], ax
lea eax, [ebp - 0x20a6]
push eax
call fcn.00537010
mov eax, dword [0x583f38]
mov dword [ebp - 0x14], eax
mov eax, dword [0x583f3c]
mov dword [ebp - 0x10], eax
xor eax, eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
add esp, 0xc
stosw word es:[edi], ax
lea eax, [ebp - 0x20b0]
push eax
push str.SoftwareMicrosoftInternet_ExplorerTypedUrls
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x453dd9
xor eax, eax
jmp 0x453eea
xor eax, eax
mov dword [ebp - 0x20ac], eax
lea edi, [ebx + 8]
jmp 0x453deb
mov esi, 0x1046
cmp eax, 0xa
jge 0x453ed8
mov dword [ebp - 0x20b4], esi
lea esi, [eax + 1]
push 0xa
lea eax, [ebp - 0xe]
push eax
push esi
call fcn.005338eb
add esp, 0xc
lea eax, [ebp - 0x20b4]
push eax
lea eax, [ebp - 0x1060]
push eax
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x20b0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x453ecd
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.http:__
lea eax, [ebp - 0x1060]
push eax
call ebx
lea ecx, [ebp - 0x1060]
cmp eax, ecx
je 0x453e68
push str.https:__
mov eax, ecx
push eax
call ebx
lea ecx, [ebp - 0x1060]
cmp eax, ecx
jne 0x453ecd
lea eax, [ebp - 0x1060]
push eax
lea eax, [edi + 4]
push eax
call fcn.004082ed
call fcn.004352dc
mov ebx, eax
test ebx, ebx
je 0x453eaf
lea eax, [ebp - 0x20a8]
push 0x824
push eax
lea edx, [ebp - 0x1060]
call fcn.0049a2d5
pop ecx
pop ecx
lea eax, [ebp - 0x20a8]
push eax
push edi
call fcn.004082ed
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jne 0x453ec4
lea eax, [ebp - 0x1060]
push eax
push edi
call fcn.004082ed
inc dword [ebp - 0x20ac]
add edi, 0x6c
mov eax, esi
cmp eax, 0xa
jl 0x453de6
push dword [ebp - 0x20b0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x20ac]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052f7d0
leave
ret
Function at 0x45415a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5616db
mov eax, dword fs:[0]
push eax
mov eax, 0x1084
call fcn.005482e0
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
push 0x1046
mov word [ebp - 0x1070], ax
xor esi, esi
lea eax, [ebp - 0x106e]
push esi
push eax
mov ebx, ecx
call fcn.00537010
mov eax, dword [0x583f38]
mov dword [ebp - 0x24], eax
mov eax, dword [0x583f3c]
mov dword [ebp - 0x20], eax
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edi, [ebx + 0x1110]
add esp, 0xc
mov eax, edi
mov dword [ebp - 0x1080], 1
call fcn.0045488e
lea eax, [ebp - 0x1078]
push eax
push str.SoftwareMicrosoftInternet_ExplorerTypedUrls
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x454328
push 0xa
lea eax, [ebp - 0x1e]
push eax
push 1
mov dword [ebp - 0x107c], 0x1046
call fcn.005338eb
jmp 0x4542f1
cmp word [ebp - 0x1070], si
je 0x4542c7
mov eax, dword [0x5beb28]
mov ecx, 0x5beb28
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1074], eax
lea eax, [ebp - 0x1070]
push eax
lea eax, [ebp - 0x1074]
push eax
mov dword [ebp - 4], esi
call fcn.004082ed
mov ecx, dword [edi + 0xc]
cmp ecx, esi
jne 0x45425d
xor eax, eax
jmp 0x454265
mov eax, dword [edi + 0x14]
sub eax, ecx
sar eax, 2
mov ebx, dword [edi + 0x10]
mov edx, ebx
sub edx, ecx
sar edx, 2
cmp edx, eax
jae 0x454287
lea eax, [ebp - 0x1074]
xor esi, esi
push eax
inc esi
call fcn.00454fbb
mov dword [edi + 0x10], eax
jmp 0x4542b3
lea esi, [ebp - 0x1088]
call fcn.00454fe1
push dword [ebp - 0x1084]
lea eax, [ebp - 0x1074]
push dword [ebp - 0x1088]
push eax
lea eax, [ebp - 0x1090]
push eax
mov eax, edi
call fcn.004547df
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1074]
add eax, 0xfffffff0
call fcn.00407d09
xor esi, esi
inc dword [ebp - 0x1080]
push 0xa
lea eax, [ebp - 0x1e]
push eax
push dword [ebp - 0x1080]
call fcn.005338eb
xor eax, eax
mov dword [ebp - 0x107c], 0x1046
mov word [ebp - 0x1070], ax
add esp, 0xc
lea eax, [ebp - 0x107c]
push eax
lea eax, [ebp - 0x1070]
push eax
push esi
push esi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x1078]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x454219
push dword [ebp - 0x1078]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052f7d0
leave
ret
Function at 0x454342
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x218], 0
push ebx
push esi
push edi
mov edi, str.SoftwareMicrosoftInternet_ExplorerTypedUrls
push edi
mov esi, 0x80000001
push esi
mov ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0x218]
push eax
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x45444e
lea esi, [ebx + 0x1110]
mov ebx, dword [esi + 0x10]
sub ebx, dword [esi + 0xc]
sar ebx, 2
cmp ebx, 0x18
jle 0x4543a1
push 0x18
pop ebx
mov eax, dword [0x583f38]
mov dword [ebp - 0x20c], eax
mov eax, dword [0x583f3c]
push 0x200
mov dword [ebp - 0x208], eax
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.00537010
and dword [ebp - 0x210], 0
add esp, 0xc
test ebx, ebx
jle 0x454442
mov dword [ebp - 0x214], 1
mov edi, dword [ebp - 0x210]
call fcn.004264b0
mov edi, eax
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jle 0x454434
push 0xa
lea eax, [ebp - 0x206]
push eax
push dword [ebp - 0x214]
call fcn.005338eb
mov eax, dword [edi]
mov ecx, dword [eax - 0xc]
add esp, 0xc
add ecx, ecx
push ecx
push eax
push 1
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
inc dword [ebp - 0x214]
inc dword [ebp - 0x210]
cmp dword [ebp - 0x210], ebx
jl 0x4543e2
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052f7d0
leave
ret