joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a330
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x38], 0
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
push 0x54ba28
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x24], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x34]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x3c]
mov dword [ecx + 0x10], edx
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x40]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
mov dword [edx], eax
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x1c]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x44]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
mov dword [eax + 0xc], edx
mov esp, ebp
pop ebp
ret

Function at 0x42a3e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 0x38
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x70
call fcn.00403290
push 0x54ba44
mov ecx, dword [ebp - 4]
add ecx, 0x70
call fcn.004032e0
mov ecx, dword [ebp - 4]
add ecx, 0x70
call fcn.004017c0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42a433
mov ecx, dword [ebp - 4]
add ecx, 0x70
call fcn.004017c0
push eax
call fcn.0042c050
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x42a440
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5925f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.004caa30
add esp, 0xc
push str.AllSkin
mov ecx, dword [ebp - 0x214]
add ecx, 0x38
call fcn.004017c0
push eax
push 0x54ba60
lea ecx, [ebp - 0x210]
push ecx
call fcn.004cb62b
add esp, 0x10
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42a4c0
lea eax, [ebp - 0x210]
push eax
call fcn.0042c050
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ca9d7
mov esp, ebp
pop ebp
ret
Function at 0x42a4d0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5925f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.004caa30
add esp, 0xc
push 0x54ba6c
mov ecx, dword [ebp - 0x214]
add ecx, 0x1c
call fcn.004017c0
push eax
push 0x54ba74
lea ecx, [ebp - 0x210]
push ecx
call fcn.004cb62b
add esp, 0x10
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42a550
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.Dict
mov ecx, dword [ebp - 0x214]
add ecx, 0x1c
call fcn.004017c0
push eax
push 0x54ba8c
lea ecx, [ebp - 0x210]
push ecx
call fcn.004cb62b
add esp, 0x10
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42a598
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ca9d7
mov esp, ebp
pop ebp
ret

Function at 0x42a5b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5925f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
push 0x54ba98
mov ecx, dword [ebp - 0x214]
add ecx, 0x38
call fcn.004017c0
push eax
push 0x54baa8
lea eax, [ebp - 0x210]
push eax
call fcn.004cb62b
add esp, 0x10
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42a611
lea edx, [ebp - 0x210]
push edx
call fcn.0042c050
add esp, 4
push 0x54bab4
lea eax, [ebp - 0x210]
push eax
call fcn.004ca9e6
add esp, 8
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp - 0x214]
add ecx, 0x54
call fcn.004032b0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ca9d7
mov esp, ebp
pop ebp
ret

Function at 0x42a650
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5925f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
push 0x54bacc
mov ecx, dword [ebp - 0x214]
add ecx, 0x38
call fcn.004017c0
push eax
push 0x54badc
lea eax, [ebp - 0x210]
push eax
call fcn.004cb62b
add esp, 0x10
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42a6b1
lea edx, [ebp - 0x210]
push edx
call fcn.0042c050
add esp, 4
push str.Related.ini
lea eax, [ebp - 0x210]
push eax
call fcn.004ca9e6
add esp, 8
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp - 0x214]
add ecx, 0xc4
call fcn.004032b0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ca9d7
mov esp, ebp
pop ebp
ret
Function at 0x42a760
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5925f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
push str.UseData
mov ecx, dword [ebp - 0x214]
add ecx, 0x38
call fcn.004017c0
push eax
push 0x54bb50
lea eax, [ebp - 0x210]
push eax
call fcn.004cb62b
add esp, 0x10
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42a7c1
lea edx, [ebp - 0x210]
push edx
call fcn.0042c050
add esp, 4
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x214]
add ecx, 0x118
call fcn.004032b0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ca9d7
mov esp, ebp
pop ebp
ret
Function at 0x42af50
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x860
mov eax, dword [0x5925f0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x860], ecx
mov word [ebp - 0x650], 0
push 0x206
push 0
lea eax, [ebp - 0x64e]
push eax
call fcn.004caa30
add esp, 0xc
mov word [ebp - 0x440], 0
push 0x206
push 0
lea ecx, [ebp - 0x43e]
push ecx
call fcn.004caa30
add esp, 0xc
mov dword [ebp - 0x85c], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x85c], eax
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x238], 0
push 0x228
push 0
lea edx, [ebp - 0x234]
push edx
call fcn.004caa30
add esp, 0xc
mov word [ebp - 0x858], 0
push 0x206
push 0
lea eax, [ebp - 0x856]
push eax
call fcn.004caa30
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x444], 0xffffffff
jne 0x42b023
jmp 0x42b0be
mov dword [ebp - 0x238], 0x22c
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x444]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x42b081
mov eax, dword [ebp - 0x230]
cmp eax, dword [ebp - 0x85c]
jne 0x42b06a
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x440]
push edx
call fcn.004caa10
add esp, 8
jmp 0x42b081
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [ebp - 0x444]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x42b044
cmp dword [ebp - 0x444], 0xffffffff
je 0x42b097
mov edx, dword [ebp - 0x444]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x440]
push eax
call fcn.004cd5e9
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x860]
add ecx, 0x134
call fcn.004032b0
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004ca9d7
mov esp, ebp
pop ebp
ret

Function at 0x42b2c0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x5925f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x12c], ecx
push 0x11c
push 0
lea eax, [ebp - 0x128]
push eax
call fcn.004caa30
add esp, 0xc
mov dword [ebp - 0x128], 0x11c
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x124], 6
jne 0x42b331
cmp dword [ebp - 0x120], 0
je 0x42b321
cmp dword [ebp - 0x120], 1
jne 0x42b331
movzx edx, byte [ebp - 0xe]
cmp edx, 1
jne 0x42b331
mov eax, 1
jmp 0x42b333
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ca9d7
mov esp, ebp
pop ebp
ret
Function at 0x42b350
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5925f0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x214], ecx
push 0
push 0x1a
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x210]
push ecx
call fcn.004caee6
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42b396
jmp 0x42b407
push 0x54bcfc
lea edx, [ebp - 0x210]
push edx
call fcn.004ca9e6
add esp, 8
push 0x54bd00
lea eax, [ebp - 0x210]
push eax
call fcn.004ca9e6
add esp, 8
push 0x54bd10
lea ecx, [ebp - 0x210]
push ecx
call fcn.004ca9e6
add esp, 8
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42b3f2
lea eax, [ebp - 0x210]
push eax
call fcn.0042c050
add esp, 4
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp - 0x214]
add ecx, 0x38
call fcn.004032b0
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004ca9d7
mov esp, ebp
pop ebp
ret

Function at 0x42b420
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5925f0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x214], ecx
push 0
push 0x1a
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x210]
push ecx
call fcn.004caee6
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42b466
jmp 0x42b4d7
push 0x54bd14
lea edx, [ebp - 0x210]
push edx
call fcn.004ca9e6
add esp, 8
push 0x54bd18
lea eax, [ebp - 0x210]
push eax
call fcn.004ca9e6
add esp, 8
push 0x54bd34
lea ecx, [ebp - 0x210]
push ecx
call fcn.004ca9e6
add esp, 8
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42b4c2
lea eax, [ebp - 0x210]
push eax
call fcn.0042c050
add esp, 4
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp - 0x214]
add ecx, 0x1c
call fcn.004032b0
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004ca9d7
mov esp, ebp
pop ebp
ret
Function at 0x42b4f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x5925f0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x62c], ecx
mov word [ebp - 0x420], 0
push 0x206
push 0
lea eax, [ebp - 0x41e]
push eax
call fcn.004caa30
add esp, 0xc
push 0x54bd38
lea ecx, [ebp - 0x420]
push ecx
call fcn.004caa10
add esp, 8
push 0x54bd4c
lea edx, [ebp - 0x420]
push edx
call fcn.004ca9e6
add esp, 8
mov ecx, dword [ebp - 0x62c]
add ecx, 0x38
call fcn.004017c0
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.004caa10
add esp, 8
mov ecx, dword [ebp - 0x62c]
add ecx, 0x1c
call fcn.004017c0
push eax
lea ecx, [ebp - 0x628]
push ecx
call fcn.004caa10
add esp, 8
lea edx, [ebp - 4]
push edx
push 2
push 0
lea eax, [ebp - 0x420]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x42b5f3
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push 1
push 0
push 0x54bd5c
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x104
lea eax, [ebp - 0x628]
push eax
push 1
push 0
push 0x54bd74
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004ca9d7
mov esp, ebp
pop ebp
ret

Function at 0x42c050
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
push eax
call fcn.004caee6
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 1
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004aa3b0
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.004caa10
add esp, 8
mov byte [ebp - 1], 1
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
jmp 0x42c0ba
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 8]
jg 0x42c128
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax + edx*2]
cmp ecx, 0x5c
jne 0x42c126
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov cx, word [eax + edx*2]
mov word [ebp - 0x18], cx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov word [eax + edx*2], 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42c10f
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x42c10f
mov byte [ebp - 1], 0
jmp 0x42c128
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dx, word [ebp - 0x18]
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x42c0b1
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.004aa3b5
add esp, 4
movzx eax, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x42dbb0
Capabilities:
Check if file exists
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x5925f0]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x42dbf5
xor eax, eax
jmp 0x42dcf4
mov word [ebp - 0x220], 0
push 0x206
push 0
lea ecx, [ebp - 0x21e]
push ecx
call fcn.004caa30
add esp, 0xc
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 4], 1
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0x54bfa4
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42dcd2
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov word [ebp - 0x428], 0
push 0x206
push 0
lea edx, [ebp - 0x426]
push edx
call fcn.004caa30
add esp, 0xc
push 0
push 0x26
lea eax, [ebp - 0x428]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.Internet_Exploreriexplore.exe
lea ecx, [ebp - 0x428]
push ecx
call fcn.004ca9e6
add esp, 8
lea edx, [ebp - 0x428]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42dcb8
xor eax, eax
jmp 0x42dcf4
lea eax, [ebp - 0x428]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004caa10
add esp, 8
mov eax, 1
jmp 0x42dcf4
lea edx, [ebp - 0x220]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004caa10
add esp, 8
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004ca9d7
mov esp, ebp
pop ebp
ret
Function at 0x42dd10
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x5925f0]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x23c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x228], 0
mov word [ebp - 0x448], 0
push 0x206
push 0
lea eax, [ebp - 0x446]
push eax
call fcn.004caa30
add esp, 0xc
mov word [ebp - 0x220], 0
push 0x206
push 0
lea ecx, [ebp - 0x21e]
push ecx
call fcn.004caa30
add esp, 0xc
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x44c], 1
lea edx, [ebp - 0x10]
push edx
push 0x20019
push 0
push 0x54bfe8
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x42dde3
xor eax, eax
jmp 0x42df40
lea eax, [ebp - 0x22c]
push eax
push 0x20019
push 0
push 0x54bff4
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x42de16
xor eax, eax
jmp 0x42df40
lea edx, [ebp - 0x234]
push edx
push 0x20019
push 0
push 0x54c000
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x42de4c
xor eax, eax
jmp 0x42df40
mov dword [ebp - 0x228], 0x104
mov dword [ebp - 8], 1
lea ecx, [ebp - 0x228]
push ecx
lea edx, [ebp - 0x448]
push edx
lea eax, [ebp - 8]
push eax
push 0
push 0x54c01c
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x448]
push ecx
call fcn.004cd5e9
add esp, 4
mov dword [ebp - 0x224], eax
push 0x54c020
mov edx, dword [ebp - 0x224]
push edx
call fcn.00430400
add esp, 8
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 0
jne 0x42ded9
xor eax, eax
jmp 0x42df40
mov eax, dword [ebp - 0x450]
add eax, 2
mov dword [ebp - 0x224], eax
mov ecx, dword [ebp - 0x224]
mov dword [ebp - 0x238], ecx
push 0x54c024
mov edx, dword [ebp - 0x224]
push edx
call fcn.00430400
add esp, 8
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 0
jne 0x42df1b
xor eax, eax
jmp 0x42df40
mov eax, dword [ebp - 0x450]
mov word [eax], 0
mov ecx, dword [ebp - 0x238]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42df3b
xor eax, eax
jmp 0x42df40
mov eax, 1
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004ca9d7
mov esp, ebp
pop ebp
ret
Function at 0x42e130
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0x5925f0]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x238], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x228], 0
mov word [ebp - 0x440], 0
push 0x206
push 0
lea eax, [ebp - 0x43e]
push eax
call fcn.004caa30
add esp, 0xc
mov word [ebp - 0x220], 0
push 0x206
push 0
lea ecx, [ebp - 0x21e]
push ecx
call fcn.004caa30
add esp, 0xc
mov dword [ebp - 0x10], 0x104
mov dword [ebp - 0x444], 1
lea edx, [ebp - 0x14]
push edx
push 0x20019
push 0
push str.htmlfile
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x42e203
xor eax, eax
jmp 0x42e2f7
lea eax, [ebp - 0x22c]
push eax
push 0x20019
push 0
push str.shell
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x42e236
xor eax, eax
jmp 0x42e2f7
lea edx, [ebp - 0x234]
push edx
push 0x20019
push 0
push str.opencommand
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x42e26c
xor eax, eax
jmp 0x42e2f7
mov dword [ebp - 0x228], 0x104
mov dword [ebp - 0xc], 1
lea ecx, [ebp - 0x228]
push ecx
lea edx, [ebp - 0x440]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push 0x54c0ac
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x440]
push ecx
call fcn.004cd5e9
add esp, 4
mov dword [ebp - 0x224], eax
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x224]
push eax
call fcn.00430400
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x42e2f2
xor eax, eax
jmp 0x42e2f7
mov eax, 1
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.004ca9d7
mov esp, ebp
pop ebp
ret

Function at 0x42e450
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfe0
mov eax, dword [0x5925f0]
xor eax, ebp
mov dword [ebp - 0x40], eax
push 0x7d0
lea eax, [ebp - 0xfe0]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x54c0f8
lea ecx, [ebp - 0xfd4]
push ecx
call fcn.004caa10
add esp, 8
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0xfe0]
push eax
call fcn.004ca9e6
add esp, 8
push 0x3c
push 0
lea ecx, [ebp - 0x3c]
push ecx
call fcn.004caa30
add esp, 0xc
mov dword [ebp - 0x30], 0x54c158
mov dword [ebp - 0x38], 0x200
mov edx, dword [ebp + 8]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], 1
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x54c164
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x42e4f2
lea ecx, [ebp - 0xfe0]
push ecx
call fcn.0042e5a0
add esp, 4
mov ecx, dword [ebp - 0x40]
xor ecx, ebp
call fcn.004ca9d7
mov esp, ebp
pop ebp
ret
Function at 0x42e530
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [ebp + 8]
push eax
call fcn.004caee6
add esp, 4
test eax, eax
jne 0x42e548
jmp 0x42e59b
push 0x3c
push 0
lea ecx, [ebp - 0x3c]
push ecx
call fcn.004caa30
add esp, 0xc
mov dword [ebp - 0x30], 0x54c170
mov dword [ebp - 0x38], 0x200
mov edx, dword [ebp + 8]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], 1
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x54c17c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x42e59b
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042e5a0
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x42e5a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x5925f0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x44
push 0
lea eax, [ebp - 0x830]
push eax
call fcn.004caa30
add esp, 0xc
mov dword [ebp - 0x830], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x7e8]
push ecx
call fcn.004caa30
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 0x54c188
lea eax, [ebp - 0x7d8]
push eax
call fcn.004cb62b
add esp, 0xc
lea ecx, [ebp - 0x7e8]
push ecx
lea edx, [ebp - 0x830]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x7d8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x42e62a
jmp 0x42e644
mov ecx, dword [ebp - 0x7e8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x7e4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ca9d7
mov esp, ebp
pop ebp
ret

Function at 0x42e7c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 0x3c], 0x3c
push 0x38
push 0
lea eax, [ebp - 0x38]
push eax
call fcn.004caa30
add esp, 0xc
mov dword [ebp - 0x30], str.runas
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x38], 0x200
mov dword [ebp - 0x20], 1
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x28], edx
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x42e815
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40], eax
mov eax, 1
mov esp, ebp
pop ebp
ret