joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ce50
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5555e7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], esi
mov dword [esi], 0x569e58
mov dword [ebp - 4], 0
mov edx, dword [0x5c74b0]
mov eax, dword [esi + 0x24]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x14]
push 4
push ecx
push 4
push 0
push str.LargeButtons
push edx
mov byte [ebp - 4], 2
mov dword [ebp - 0x14], eax
call ebx
mov eax, dword [esi + 0x20]
lea edi, [esi + 0x1c]
test eax, eax
je 0x41ced0
mov ecx, dword [esi + 8]
lea eax, [eax + eax*4]
mov edx, dword [ecx + eax*4 - 0x14]
push edx
push 0x5a3e24
push edi
call fcn.0053afda
add esp, 0xc
jmp 0x41cede
push str.Classic_Buttons
push edi
call fcn.0053afda
add esp, 8
mov edx, dword [edi]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x41cf0b
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
mov eax, dword [0x5c74b0]
push str.ToolbarStyle
push eax
call ebx
jmp 0x41cf28
mov ecx, dword [0x5c74b0]
push str.ToolbarStyle
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x41cf28
lea ecx, [esi + 0x1c]
mov dword [ebp - 4], 0
call fcn.005421be
lea ebx, [esi + 4]
mov dword [ebp - 0x14], ebx
mov dword [ebx], method.CCommandLineInfo.virtual_0
mov esi, dword [ebx + 4]
mov dword [ebp - 4], 4
test esi, esi
je 0x41cfb1
mov eax, dword [ebx + 8]
mov dword [ebp - 0x18], esi
mov edx, eax
dec eax
test edx, edx
je 0x41cfa5
lea edi, [eax + 1]
lea ecx, [esi + 0x10]
mov byte [ebp - 4], 8
call fcn.005421be
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 7
call fcn.005421be
lea ecx, [esi + 8]
mov byte [ebp - 4], 6
call fcn.005421be
lea ecx, [esi + 4]
mov byte [ebp - 4], 5
call fcn.005421be
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.005421be
add esi, 0x14
dec edi
mov dword [ebp - 0x18], esi
jne 0x41cf61
mov eax, dword [ebx + 4]
push eax
call fcn.00542796
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41f290
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov edx, dword [0x5c74b0]
push esi
mov esi, ecx
lea eax, [esp + 4]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0xc]
push eax
push ecx
push 0
push 0
push str.isUseWinDialUp
push edx
mov dword [esp + 0x20], 4
call edi
test eax, eax
je 0x41f2ce
mov dword [esi + 0x28], 0
jmp 0x41f2dc
mov eax, dword [esp + 0xc]
mov dword [esi + 0x1c], 1
mov dword [esi + 0x28], eax
mov eax, dword [0x5c74b0]
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push ecx
push edx
push 0
push 0
push str.mAttempts
push eax
mov dword [esp + 0x20], 4
call edi
test eax, eax
je 0x41f30c
mov dword [esi + 0x24], 0
jmp 0x41f313
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x24], ecx
mov ecx, dword [0x5c74b0]
lea edx, [esp + 8]
lea eax, [esp + 0xc]
push edx
push eax
push 0
push 0
push str.mRedialTime
push ecx
mov dword [esp + 0x20], 4
call edi
test eax, eax
je 0x41f348
mov dword [esi + 0x20], 0x1e
pop edi
pop esi
add esp, 8
ret
mov edx, dword [esp + 0xc]
pop edi
mov dword [esi + 0x20], edx
pop esi
add esp, 8
ret

Function at 0x41f360
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x28]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [esi + 0x28]
test ecx, ecx
jne 0x41f37b
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x41f38f
push 4
push eax
mov eax, dword [0x5c74b0]
push 4
push 0
push str.isUseWinDialUp
push eax
call edi
mov edx, dword [0x5c74b0]
lea ecx, [esi + 0x24]
push 4
push ecx
push 4
push 0
push str.mAttempts
push edx
call edi
mov eax, dword [0x5c74b0]
add esi, 0x20
push 4
push esi
push 4
push 0
push str.mRedialTime
push eax
call edi
pop edi
pop esi
ret
Function at 0x423160
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x555f90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x318
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x10], esp
mov eax, dword [esi + 0x80]
lea edx, [ebp - 0x324]
push ecx
push edx
lea ecx, [ebp - 0x124]
lea edx, [ebp - 0x20]
push ecx
xor ebx, ebx
push edx
push eax
mov dword [ebp - 4], ebx
call fcn.0052776a
mov eax, dword [esi + 0xec]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
add esp, 0x14
push ebx
push ebx
push 0xf0
push eax
call edi
mov ecx, dword [0x5c2a74]
cmp eax, ebx
setne byte [ebp - 0x11]
mov dword [ebp - 0x18], ecx
mov edx, dword [esi + 0x128]
push ebx
push ebx
push 0x147
push edx
mov byte [ebp - 4], 1
call edi
lea ecx, [ebp - 0x18]
push ecx
push eax
lea ecx, [esi + 0x10c]
call fcn.0054a055
mov eax, dword [esi + 0x5c]
cmp ebx, dword [eax + 8]
jge 0x423278
mov edx, dword [eax + 4]
lea edi, [ebx + ebx*4]
shl edi, 2
mov eax, dword [edx + edi + 4]
push eax
mov eax, dword [ebp - 0x18]
push eax
call fcn.00526f6c
add esp, 8
test eax, eax
jne 0x423275
mov ecx, dword [esi + 0x5c]
mov edx, dword [ecx + 4]
mov cl, byte [ebp - 0x11]
lea eax, [edx + edi + 0x10]
mov dl, byte [edx + edi + 0x10]
cmp dl, cl
jne 0x42323f
test cl, cl
je 0x423306
test cl, cl
mov byte [eax], cl
je 0x423268
mov edx, dword [esi + 0x5c]
lea eax, [ebp - 0x124]
push eax
lea ecx, [ebp - 0x20]
mov eax, dword [edx + 4]
push ecx
push 0x5a4b44
lea ecx, [eax + edi + 8]
push ecx
call fcn.0053afda
add esp, 0x10
mov ecx, dword [esi + 0x5c]
call fcn.004615a0
jmp 0x423306
inc ebx
jmp 0x4231fc
xor al, al
test al, al
jne 0x423306
mov bl, byte [ebp - 0x11]
mov ecx, dword [0x5c74b0]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0x24]
push 4
xor edx, edx
push eax
push 4
test bl, bl
push 0
push str.RememberLastSave
setne dl
push ecx
mov dword [ebp - 0x24], edx
call esi
test bl, bl
je 0x423306
mov edx, dword [0x5c2a74]
mov dword [ebp - 0x1c], edx
lea eax, [ebp - 0x124]
lea ecx, [ebp - 0x20]
push eax
push ecx
lea edx, [ebp - 0x1c]
push 0x5a4b44
push edx
mov byte [ebp - 4], 2
call fcn.0053afda
mov edx, dword [ebp - 0x1c]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
mov eax, dword [0x5c74b0]
push str.LocalPath
push eax
call esi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.005421be
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.005421be
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x423600
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x556000
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x314
mov eax, dword [0x5c2a74]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
mov eax, dword [ebx + 0x5c]
cmp edi, dword [eax + 8]
jge 0x4236a4
mov ecx, dword [eax + 4]
mov edx, dword [ebp + 8]
lea esi, [edi + edi*4]
shl esi, 2
mov eax, dword [ecx + esi + 4]
mov ecx, dword [edx]
push eax
push ecx
call fcn.00526f6c
add esp, 8
test eax, eax
jne 0x4236a1
mov eax, dword [ebx + 0x5c]
mov edx, dword [ebx + 0x70]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + esi]
mov dword [edx + 0x354], eax
mov ecx, dword [ebx + 0x5c]
mov edx, dword [ecx + 4]
lea ecx, [ebp - 0x14]
lea eax, [edx + esi + 8]
push eax
call fcn.005422f7
mov ecx, dword [ebx + 0x5c]
xor eax, eax
push 0
mov edx, dword [ecx + 4]
mov al, byte [edx + esi + 0x10]
push eax
mov eax, dword [ebx + 0xec]
push 0xf1
push eax
jmp 0x4236f8
inc edi
jmp 0x423637
xor al, al
test al, al
jne 0x4236fe
mov ecx, dword [ebx + 0x70]
lea edx, [ebp - 0x14]
xor esi, esi
push edx
mov dword [ecx + 0x354], esi
call fcn.004261d0
mov edx, dword [0x5c74b0]
add esp, 4
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x1c]
push eax
push ecx
push esi
push esi
push str.RememberLastSave
push edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebx + 0xec]
push esi
push eax
push 0xf1
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [0x5c2a74]
mov dword [ebp - 0x18], edx
mov al, byte [ebp + 0xc]
mov byte [ebp - 4], 2
test al, al
je 0x423788
mov eax, dword [ebx + 0x80]
lea ecx, [ebp - 0x220]
lea edx, [ebp - 0x120]
lea esi, [ebx + 0x80]
push ecx
push edx
lea ecx, [ebp - 0x320]
lea edx, [ebp + 0xc]
push ecx
push edx
push eax
call fcn.0052776a
mov edx, dword [ebp - 0x14]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [ecx + edx - 1]
cmp al, 0x5c
mov eax, 0x5c6ff0
je 0x423761
mov eax, 0x5a5080
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x120]
push ecx
push eax
push edx
push str._s_s_s_s
push esi
call fcn.0053afda
add esp, 0x18
mov ecx, ebx
push 1
call fcn.00422db0
mov edx, dword [ebp + 8]
mov ecx, dword [0x5c7a5c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
push eax
push ecx
push edx
call fcn.0053afda
mov eax, dword [ebp - 0x18]
add esp, 0xc
lea ecx, [ebx + 0xd0]
push eax
call fcn.00541cba
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.005421be
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.005421be
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x425230
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x55630c
push eax
mov eax, dword [0x5c74b0]
mov dword fs:[0], esp
sub esp, 0x25c
test eax, eax
push esi
jne 0x4252a8
push 0x5c74b0
push 0xf003f
push 0
push str.SoftwareDownloadManager_
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4252c0
push 0
push 0x5c74b0
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareDownloadManager_
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
test esi, esi
jne 0x42536f
call fcn.00425930
mov al, 1
pop esi
mov ecx, dword [esp + 0x25c]
mov dword fs:[0], ecx
add esp, 0x268
ret
mov edx, dword [0x5c74b0]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
push 0
push str.idmvers
push edx
mov dword [esp + 0x24], 0x40
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
je 0x425365
cmp esi, 2
je 0x4252a3
mov eax, dword [0x5c2a74]
mov dword [esp + 4], eax
lea ecx, [esp + 0x50]
mov dword [esp + 0x268], 0
call fcn.0045eaa0
push esi
lea ecx, [esp + 8]
push str.Reading_of_idmvers_failed__errCode___ld_r_n
push ecx
mov byte [esp + 0x274], 1
call fcn.0053afda
mov edx, dword [esp + 0x10]
add esp, 0xc
lea ecx, [esp + 0x50]
push 1
push edx
call fcn.0045eb80
lea ecx, [esp + 0x50]
mov byte [esp + 0x268], 0
call fcn.0045eb70
lea ecx, [esp + 4]
mov dword [esp + 0x268], 0xffffffff
call fcn.005421be
jmp 0x4252a8
call fcn.00425db0
jmp 0x4252a8
mov eax, dword [0x5c2a74]
mov dword [esp + 8], eax
lea ecx, [esp + 0x158]
mov dword [esp + 0x268], 2
call fcn.0045eaa0
push esi
lea ecx, [esp + 0xc]
push str.RegCreateKeyEx___failed_during_OpenGlobalIDMRegKey____errCode___ld_r_n
push ecx
mov byte [esp + 0x274], 3
call fcn.0053afda
mov edx, dword [esp + 0x14]
add esp, 0xc
lea ecx, [esp + 0x158]
push 1
push edx
call fcn.0045eb80
lea ecx, [esp + 0x158]
mov byte [esp + 0x268], 2
call fcn.0045eb70
lea ecx, [esp + 8]
mov dword [esp + 0x268], 0xffffffff
call fcn.005421be
mov ecx, dword [esp + 0x260]
xor al, al
pop esi
mov dword fs:[0], ecx
add esp, 0x268
ret
Function at 0x4261d0
Capabilities:
Check if file exists
Get file attributes
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x556388
push eax
mov eax, dword [0x5c74b0]
mov dword fs:[0], esp
sub esp, 0xc
test eax, eax
push ebx
push esi
push edi
jne 0x426201
call fcn.00425230
test al, al
je 0x426364
mov eax, dword [0x5c2a74]
mov dword [esp + 0x10], eax
mov edx, dword [0x5c74b0]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0
push ecx
push 0
push 0
push 0
push str.LocalPath
push edx
call esi
test eax, eax
jne 0x42626b
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
call fcn.00542665
mov edx, dword [0x5c74b0]
lea ecx, [esp + 0xc]
mov edi, eax
push ecx
push edi
push 0
push 0
push str.LocalPath
push edx
call esi
test eax, eax
jne 0x42626b
mov ecx, dword [esp + 0x28]
push edi
jmp 0x42631e
lea eax, [esp + 0x14]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x426353
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push ecx
push eax
push eax
push eax
push str.Personal
push edx
call esi
test eax, eax
jne 0x426348
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
call fcn.00542665
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0xc]
mov ebx, eax
push ecx
push ebx
push 0
push 0
push str.Personal
push edx
call esi
test eax, eax
jne 0x426348
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [ecx + ebx - 1]
cmp al, 0x5c
mov eax, 0x5c6ff0
je 0x4262f1
mov eax, 0x5a5080
mov esi, dword [esp + 0x28]
push eax
push ebx
push str._s_sDownloads_
push esi
call fcn.0053afda
mov eax, dword [esi]
push eax
call fcn.005289a2
mov eax, dword [esi]
add esp, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x426323
push ebx
mov ecx, esi
call fcn.00542347
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.005421be
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.005421be
mov ecx, dword [esp + 0x18]
pop edi
pop esi
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x4268b0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x556456
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], esi
mov dword [esi], method.CWinApp.virtual_0
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x1a8]
push ebx
push eax
mov byte [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x184]
cmp eax, ebx
je 0x426911
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [esi + 0x184]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esi + 0x1a4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x1bc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], ebx
cmp ebx, eax
jae 0x426977
mov edx, dword [esi + 0x1b8]
mov ecx, ebx
shl ecx, 4
mov byte [ebp - 4], 7
mov edi, dword [edx + ecx]
test edi, edi
je 0x42696d
mov ecx, edi
call fcn.004ff780
push edi
call fcn.00542796
add esp, 4
mov dword [ebp - 4], 6
inc ebx
jmp 0x426927
mov dword [ebp - 4], 6
inc ebx
jmp 0x426927
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1b4]
call fcn.004298a0
mov eax, dword [0x5c74b0]
test eax, eax
je 0x4269a0
call fcn.00425db0
mov eax, dword [0x5c74b0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x5c7388]
test eax, eax
je 0x4269b0
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x5c7384]
test eax, eax
je 0x4269cb
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4269cb
lea ecx, [esi + 0x1cc]
mov dword [ebp - 4], 4
call fcn.0045eb70
lea eax, [esi + 0x1b4]
mov dword [ebp - 0x1c], eax
mov dword [eax], method.CCommandLineInfo.virtual_0
mov eax, dword [eax + 4]
mov byte [ebp - 4], 0xa
test eax, eax
je 0x426a00
push eax
call fcn.00542796
add esp, 4
lea ecx, [esi + 0x140]
mov byte [ebp - 4], 2
call fcn.0041ea30
lea ecx, [esi + 0xd8]
mov byte [ebp - 4], 1
call fcn.0040b360
lea ecx, [esi + 0xc0]
mov byte [ebp - 4], 0
call fcn.004b5300
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.0054ce73
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x428f10
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10c
lea eax, [esp]
push ebx
push ebp
push esi
push edi
push 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.IDMan.CIDMLinkTransmitter
push connect
call esi
test eax, eax
je 0x428f51
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10c
ret
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push 0
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.CLSID
push edx
call esi
test eax, eax
je 0x428f82
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10c
ret
mov edi, str.AC746233_E9D3_49CD_862F_068F7B7CCCA4
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
repne scasb al, byte es:[edi]
not ecx
push ecx
push str.AC746233_E9D3_49CD_862F_068F7B7CCCA4
push 1
push eax
push eax
mov eax, dword [esp + 0x28]
push eax
call ebx
test eax, eax
je 0x428fb8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10c
ret
mov ecx, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call ebp
mov edx, dword [esp + 0x10]
push edx
call ebp
lea eax, [esp + 0x10]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.CLSIDAC746233_E9D3_49CD_862F_068F7B7CCCA4
push connect
call esi
test eax, eax
je 0x428ffd
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10c
ret
mov edi, str.IDMan.CIDMLinkTransmitter
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push str.IDMan.CIDMLinkTransmitter
push 1
push eax
push eax
push ecx
call ebx
test eax, eax
je 0x42902d
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10c
ret
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push 0
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push str.LocalServer32
push eax
call esi
test eax, eax
je 0x42905e
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10c
ret
lea ecx, [esp + 0x18]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x429081
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10c
ret
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
push eax
mov eax, dword [esp + 0x28]
push eax
call ebx
test eax, eax
je 0x4290b0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10c
ret
mov ecx, dword [esp + 0x14]
push ecx
call ebp
mov edx, dword [esp + 0x10]
push edx
call ebp
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x10c
ret
Function at 0x437550
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push esi
mov esi, dword [esp + 8]
lea eax, [esp + 8]
push edi
push eax
push esi
mov dword [esi], 0
mov ecx, dword [0x5c74b0]
push 0
push 0
push str.LastReferer
push ecx
mov dword [esp + 0x24], 0x7d0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [0x5c74b0]
push str.LastReferer
push edx
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test edi, edi
je 0x43759f
pop edi
xor eax, eax
pop esi
ret 4
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 4
jae 0x4375b5
pop edi
pop esi
ret 4
push 6
push str.http:_
push esi
call fcn.00528c80
add esp, 0xc
test eax, eax
je 0x4375e4
push 7
push str.https:_
push esi
call fcn.00528c80
add esp, 0xc
test eax, eax
je 0x4375e4
pop edi
xor eax, eax
pop esi
ret 4
pop edi
mov eax, 1
pop esi
ret 4

Function at 0x437670
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x557640
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
mov edx, dword [0x5c74b0]
push esi
push edi
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x14]
push eax
push ecx
push 0
push 0
push str.LastCheckQU
push edx
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x437736
push ecx
mov ecx, dword [ebp - 0x14]
mov eax, esp
mov dword [ebp - 0x20], esp
push 0
mov dword [eax], ecx
call fcn.00528272
add esp, 4
lea ecx, [ebp - 0x20]
push eax
call fcn.00437780
lea edx, [ebp - 0x24]
mov ecx, eax
push edx
call fcn.00437790
mov ecx, dword [eax]
mov eax, 0xc22e4507
imul ecx
add edx, ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add edx, eax
xor eax, eax
cmp edx, 0xe
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x14]
push edx
call fcn.00528272
mov ecx, dword [0x5c74b0]
add esp, 4
lea eax, [ebp - 0x14]
push 4
push eax
push 0
push 0
push str.LastCheckQU
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x437d20
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov edx, dword [0x5c74b0]
lea eax, [esp]
lea ecx, [esp + 4]
push eax
push ecx
push 0
push 0
push str.ShowDropTarget
push edx
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x437d55
xor al, al
add esp, 8
ret
mov eax, dword [esp + 4]
test eax, eax
setne al
add esp, 8
ret

Function at 0x437e00
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5576bb
push eax
mov dword fs:[0], esp
sub esp, 0x110
mov ecx, 0x5c7408
push ebx
push ebp
push esi
mov esi, dword [esp + 0x12c]
push edi
mov edi, dword [esp + 0x134]
lea eax, [edi + 1]
push eax
push esi
call fcn.0041b150
mov ebp, dword [esp + 0x140]
test eax, eax
je 0x437e56
mov ebx, dword [esp + 0x13c]
mov byte [ebx], 1
jmp 0x437f20
mov ecx, dword [0x5c2a74]
mov dword [esp + 0x10], ecx
push esi
lea edx, [esp + 0x14]
push str.MIMEDatabaseContent_Type_s
push edx
mov dword [esp + 0x134], 0
call fcn.0053afda
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push 1
push 0
push ecx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [esp + 0x13c]
test eax, eax
jne 0x437f0c
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push 0
push str.Extension
push ecx
mov dword [esp + 0x30], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x437f01
lea edx, [esp + 0x1c]
push edx
push edi
call fcn.0052f680
add esp, 8
test eax, eax
jne 0x437ee3
mov byte [ebx], 1
jmp 0x437f01
mov ecx, dword [esp + 0x138]
lea eax, [esp + 0x1d]
push eax
push 0x5a3e24
push ecx
call fcn.0053afda
add esp, 0xc
mov byte [ebp], 1
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
mov dword [esp + 0x128], 0xffffffff
call fcn.005421be
cmp byte [ebx], 0
jne 0x437f46
cmp byte [ebp], 0
jne 0x437f46
mov eax, dword [esp + 0x138]
mov ecx, 0x5c7408
push eax
push esi
call fcn.0041b2d0
test eax, eax
je 0x437f46
mov byte [ebp], 1
mov ecx, dword [esp + 0x120]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x11c
ret 0x14