joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405b63
Capabilities:
Read file on windows

Disassembly:
push 0x4c
mov eax, 0x46470a
call fcn.0046049c
xor esi, esi
push 0x2c
lea eax, [ebp - 0x3c]
mov ebx, ecx
push esi
mov dword [ebp - 0x4c], esi
push eax
mov dword [ebp - 0x44], ebx
mov edi, edx
mov dword [ebp - 0x40], esi
call fcn.00456240
lea eax, [ebp - 0x40]
push eax
push edi
call fcn.00451c57
add esp, 0x14
test eax, eax
je 0x405ba9
mov esi, ebx
call fcn.00401310
mov eax, ebx
jmp 0x405c40
push 0x46b8ac
push edi
call fcn.00450b6d
pop ecx
pop ecx
mov dword [ebp - 0x48], eax
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
cmp eax, esi
jne 0x405bcf
mov esi, dword [ebp - 0x44]
call fcn.00401310
mov eax, esi
jmp 0x405c40
mov eax, dword [ebp - 0x2c]
inc eax
push eax
call fcn.0045010c
pop ecx
push eax
mov eax, dword [ebp - 0x2c]
lea edi, [ebp - 0x58]
call fcn.00401344
mov byte [ebp - 4], 2
cmp dword [ebp - 0x58], esi
jne 0x405bf9
mov esi, dword [ebp - 0x44]
call fcn.00401310
jmp 0x405c22
push dword [ebp - 0x48]
mov esi, dword [ebp - 0x54]
push dword [ebp - 0x2c]
push ebx
push esi
call fcn.00450dce
mov ecx, dword [ebp - 0x2c]
add esp, 0x10
cmp ecx, eax
jne 0x405bef
mov edi, dword [ebp - 0x44]
mov byte [esi + ecx], 0
lea esi, [ebp - 0x58]
call fcn.00401325
mov byte [ebp - 4], bl
mov esi, dword [ebp - 0x50]
mov dword [ebp - 0x4c], ebx
test esi, esi
je 0x405c34
call fcn.00401000
push dword [ebp - 0x48]
call fcn.00451328
mov eax, dword [ebp - 0x44]
pop ecx
call fcn.004604e6
ret
Function at 0x406c53
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x118
mov eax, 0x464c1b
call fcn.0046049c
mov eax, dword [ebp + 8]
xor ebx, ebx
push eax
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ebx
call fcn.00406bc3
mov edi, eax
pop ecx
mov dword [ebp - 0x124], edi
mov dword [ebp - 4], ebx
cmp edi, ebx
jne 0x406c98
push ebx
mov ecx, esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.00401424
jmp 0x406d0e
push 0x103
lea eax, [ebp - 0x117]
push ebx
push eax
mov byte [ebp - 0x118], bl
call fcn.00456240
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x118]
push eax
push ebx
push ebx
push dword [ebp - 0x120]
mov dword [ebp - 0x11c], 0x104
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
test eax, eax
je 0x406ced
mov ecx, esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.00401424
jmp 0x406d07
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x46c12a
lea eax, [ebp - 0x118]
push eax
push esi
call fcn.004054e9
add esp, 0x24
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.004604e6
ret

Function at 0x407056
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, 0x735
push esi
call fcn.0045010c
mov ebx, eax
pop ecx
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x40707c
push eax
call fcn.00450117
pop ecx
xor eax, eax
jmp 0x4070ec
push esi
push 0x46ad88
push ebx
call fcn.004562c0
add esp, 0xc
xor eax, eax
xor byte [eax + ebx], 0xaa
inc eax
cmp eax, esi
jb 0x40708d
push edi
mov edi, str.vR2WzOyEugKAvrXcUhE48cnlIHTMYLO8
push edi
push ebx
call fcn.004517e0
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x4070c8
push 0x20
mov esi, str.gpdgdlcjhlbaphcjmagicjhhgfnkiihp
push esi
push ebx
call fcn.004562c0
push edi
inc ebx
push ebx
call fcn.004517e0
add esp, 0x14
test eax, eax
jne 0x4070d5
push dword [ebp - 4]
call fcn.00450117
pop ecx
xor eax, eax
jmp 0x4070eb
push 0x20
push esi
push eax
call fcn.004562c0
push 0
call fcn.00450117
mov eax, dword [ebp - 4]
add esp, 0x10
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408012
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x474194]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 7
pop ecx
mov esi, str.ApprovedExtensionsMigration
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
mov esi, str.MAO_Settings
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x30]
push eax
push ebx
movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
and dword [ebp - 0x34], 0
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push eax
push ebx
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x408089
push 0
call fcn.004520e1
pop ecx
push 8
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
push 3
push 0
push str.Timestamp
push dword [ebp - 0x34]
mov dword [ebp - 0x3c], edx
call edi
and dword [ebp - 0x38], 0
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
call esi
test eax, eax
jne 0x4080b7
push 4
lea eax, [ebp - 0x3c]
push eax
push 4
push 0
push str.AddonLoadTimeThreshold
push dword [ebp - 0x38]
mov dword [ebp - 0x3c], 0x2710
call edi
cmp dword [ebp - 0x38], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x4080c8
push dword [ebp - 0x38]
call esi
cmp dword [ebp - 0x34], 0
je 0x4080d3
push dword [ebp - 0x34]
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.004500ac
leave
ret

Function at 0x408169
Capabilities:
Delete registry key

Disassembly:
push 0x14
mov eax, 0x464a28
call fcn.00460433
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
push str.A7A9D7E7_E0C0_4202_9F13_6A06BD073CDA
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionExtSettings_
lea eax, [ebp - 0x18]
push edi
push eax
call fcn.004054e9
add esp, 0x24
mov dword [ebp - 4], esi
cmp dword [ebp - 0x18], esi
jne 0x4081b4
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], esi
je 0x4081ad
mov esi, dword [ebp - 0x14]
call fcn.00401000
xor al, al
jmp 0x408248
push dword [ebp - 0x18]
mov ebx, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push 0x80000002
call ebx
push dword [ebp - 0x18]
push 0x80000001
call ebx
push dword [ebp - 0x18]
push ecx
call fcn.00405040
pop ecx
push eax
call ebx
push esi
push esi
push esi
push esi
push esi
push esi
push str.CF190686_9E72_403C_B99D_682ABDB63C5B
lea eax, [ebp - 0x20]
push edi
push eax
call fcn.004054e9
add esp, 0x24
mov ecx, eax
lea edi, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.0040138b
mov byte [ebp - 4], 0
cmp dword [ebp - 0x1c], esi
je 0x408214
mov esi, dword [ebp - 0x1c]
call fcn.00401000
xor esi, esi
push dword [ebp - 0x18]
push 0x80000002
call ebx
push dword [ebp - 0x18]
push 0x80000001
call ebx
push dword [ebp - 0x18]
push ecx
call fcn.00405040
pop ecx
push eax
call ebx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], esi
je 0x408246
mov esi, dword [ebp - 0x14]
call fcn.00401000
mov al, 1
call fcn.004604d2
ret
Function at 0x40824e
Capabilities:
Delete registry key

Disassembly:
push 0x1c
mov eax, 0x464bf5
call fcn.00460433
call fcn.00408426
xor ebx, ebx
mov dword [ebp - 0x14], eax
cmp eax, ebx
jne 0x40826f
xor al, al
jmp 0x408420
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x408272
sub eax, esi
xor ecx, ecx
push 2
add eax, 0x100
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0045010c
pop ecx
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call fcn.00401489
mov dword [ebp - 4], ebx
mov edi, dword [ebp - 0x20]
cmp edi, ebx
jne 0x4082c0
or dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x1c]
cmp esi, ebx
je 0x408268
call fcn.00401000
jmp 0x408268
push dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
call fcn.00405800
pop ecx
pop ecx
mov ecx, dword [eax]
mov edx, edi
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
cmp ax, bx
jne 0x4082d2
mov esi, dword [ebp - 0x14]
cmp esi, ebx
je 0x4082ef
call fcn.00401000
call fcn.00408169
test al, al
je 0x4082ae
lea eax, [ebp - 0xe]
push eax
push 0x407f0a
push 0x407f67
push edi
push edi
mov byte [ebp - 0xe], bl
call fcn.00401524
add esp, 0x14
mov byte [ebp - 0xd], al
cmp al, bl
je 0x40840d
mov dword [ebp - 0x14], ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.iexploreAllowedDomains
push str.CF190686_9E72_403C_B99D_682ABDB63C5B
lea eax, [ebp - 0x28]
push str.SoftwareMicrosoftWindowsCurrentVersionExtStats_
push eax
mov byte [ebp - 4], 1
call fcn.004054e9
add esp, 0x24
push ebx
lea ecx, [ebp - 0x14]
push ecx
push ebx
push 6
push ebx
push ebx
mov byte [ebp - 4], 2
mov eax, dword [eax]
push ebx
push eax
call fcn.00405040
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x24]
setne byte [ebp - 0xf]
cmp esi, ebx
je 0x408379
call fcn.00401000
cmp byte [ebp - 0xf], bl
je 0x408381
mov byte [ebp - 0xd], bl
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.A7A9D7E7_E0C0_4202_9F13_6A06BD073CDA
lea eax, [ebp - 0x28]
push str.SoftwareMicrosoftWindowsCurrentVersionExtSettings_
push eax
call fcn.004054e9
add esp, 0x24
mov byte [ebp - 4], 3
push dword [eax]
push ecx
call fcn.00405040
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
pop ecx
push eax
call edi
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x24]
cmp esi, ebx
je 0x4083c3
call fcn.00401000
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.CF190686_9E72_403C_B99D_682ABDB63C5B
lea eax, [ebp - 0x28]
push str.SoftwareMicrosoftWindowsCurrentVersionExtSettings_
push eax
call fcn.004054e9
add esp, 0x24
mov byte [ebp - 4], 4
push dword [eax]
push ecx
call fcn.00405040
pop ecx
push eax
call edi
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x24]
cmp esi, ebx
je 0x4083ff
call fcn.00401000
cmp dword [ebp - 0x14], ebx
je 0x40840d
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x1c]
cmp esi, ebx
je 0x40841d
call fcn.00401000
mov al, byte [ebp - 0xd]
call fcn.004604d2
ret
Function at 0x408510
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea eax, [ebp - 0x10]
push 0x46c12a
push eax
call fcn.0040554d
push dword [ebp - 0xc]
call fcn.0045fce9
push 0x2f
push dword [ebp - 0xc]
call fcn.00451a00
add esp, 0x40
cmp eax, ebx
je 0x4085c9
mov esi, 0x476040
push edi
push dword [ebp + 0x14]
lea edi, [eax + 1]
lea eax, [ebp - 4]
push eax
push 0x47601c
mov eax, esi
mov dword [ebp - 4], edi
call fcn.00408fa4
add esp, 0xc
cmp eax, esi
je case.default.0x408585
sub eax, 0x47601c
sar eax, 2
cmp eax, 8
ja case.default.0x408585
jmp dword [eax*4 + 0x4085f8]
mov eax, dword [ebp + 0xc]
jmp 0x4085b7
mov eax, dword [ebp + 0x10]
jmp 0x4085b7
mov eax, dword [ebp + 0x14]
jmp 0x4085b7
mov eax, dword [ebp + 0x18]
jmp 0x4085b7
mov eax, dword [ebp + 0x1c]
jmp 0x4085b7
mov eax, dword [ebp + 8]
jmp 0x4085b7
mov eax, dword [ebp + 0x20]
jmp 0x4085b7
mov eax, dword [ebp + 0x24]
jmp 0x4085b7
mov eax, dword [ebp + 0x28]
mov byte [eax], 1
push 0x2f
push edi
call fcn.00451a00
pop ecx
pop ecx
cmp eax, ebx
jne 0x408558
pop edi
mov edx, dword [ebp + 0x14]
cmp byte [edx], bl
jne 0x4085e7
mov ecx, dword [ebp + 0x18]
cmp byte [ecx], bl
jne 0x4085e7
mov eax, dword [ebp + 0x1c]
cmp byte [eax], bl
jne 0x4085e7
mov byte [edx], 1
mov byte [ecx], 1
mov byte [eax], 1
mov esi, dword [ebp - 8]
cmp esi, ebx
je 0x4085f3
call fcn.00401000
pop esi
pop ebx
leave
ret

Function at 0x40861c
Capabilities:
Create process on windows

Disassembly:
push 0x48
mov eax, 0x46469b
call fcn.00460433
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push str._c_taskkill__f__im
push eax
call fcn.004054e9
add esp, 0x24
mov eax, dword [ebp - 0x18]
cmp eax, esi
jne 0x408664
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], esi
je 0x40865c
mov esi, dword [ebp - 0x14]
call fcn.00401000
or eax, 0xffffffff
jmp 0x4086f3
mov dword [ebp - 0x40], eax
push 6
pop ecx
xor eax, eax
mov dword [ebp - 0x54], 0x3c
mov dword [ebp - 0x50], 0x8540
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], str.open
mov dword [ebp - 0x44], str.cmd.exe
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x34], esi
lea edi, [ebp - 0x30]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x54]
push eax
or ebx, 0xffffffff
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x4086e0
push 0xbb8
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4086e0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x4086d7
mov ebx, dword [ebp - 0x10]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], esi
je 0x4086f1
mov esi, dword [ebp - 0x14]
call fcn.00401000
mov eax, ebx
call fcn.004604d2
ret
Function at 0x4086f9
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push 0x18
mov eax, 0x464678
call fcn.00460433
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea eax, [ebp - 0x24]
push 0x46c12a
push eax
call fcn.0040554d
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x46b9a8
mov dword [ebp - 4], ebx
push dword [0x476020]
lea eax, [ebp - 0x18]
push 0x46bf18
push eax
call fcn.004054e9
add esp, 0x58
push dword [eax]
push dword [ebp - 0x20]
call fcn.004517e0
mov esi, dword [ebp - 0x14]
pop ecx
pop ecx
mov edi, eax
cmp esi, ebx
je 0x408764
call fcn.00401000
cmp edi, ebx
jne 0x40877c
or dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x1c]
cmp esi, ebx
je 0x408778
call fcn.00401000
xor al, al
jmp 0x4087ef
mov eax, dword [str.exec]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x408784
sub eax, edx
lea esi, [edi + eax + 2]
jmp 0x408794
inc esi
movsx eax, byte [esi]
push eax
call fcn.004519bd
pop ecx
test eax, eax
jne 0x408793
cmp byte [esi], 0x22
sete al
lea eax, [eax + eax + 0x20]
cmp al, 0x22
jne 0x4087b1
inc esi
movsx eax, al
push eax
push esi
call fcn.00451a00
pop ecx
pop ecx
cmp eax, ebx
je 0x4087c4
mov byte [eax], bl
inc eax
push 1
push ebx
push eax
push esi
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
setg byte [ebp - 0xd]
or dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x1c]
cmp esi, ebx
je 0x4087ec
call fcn.00401000
mov al, byte [ebp - 0xd]
call fcn.004604d2
ret

Function at 0x40880f
Capabilities:
Enumerate gui resources

Disassembly:
push 0x1c
mov eax, 0x46464b
call fcn.0046049c
lea eax, [ebp - 0x28]
push eax
call fcn.0040908f
and dword [ebp - 4], 0
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.0040911e
pop ecx
pop ecx
mov ecx, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi]
mov ecx, dword [eax]
xor eax, eax
mov byte [ebp - 0x1c], 0
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x1c]
push eax
push 0x409508
mov dword [ebp - 0x18], ecx
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esi + 4]
mov cl, byte [ebp - 0x1c]
mov byte [eax], cl
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x40887a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x40888b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp byte [ebp - 0x28], 0
je 0x408897
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
call fcn.004604e6
ret
Function at 0x409609
Capabilities:
Check mutex on windows

Disassembly:
push 0xc
mov eax, 0x464616
call fcn.00460433
xor ebx, ebx
test byte [0x477fcc], 1
jne 0x409640
or dword [0x477fcc], 1
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0x464ed2
mov dword [0x477fc8], eax
call fcn.00450a9a
pop ecx
mov dword [ebp - 0x10], ebx
push 0x3e8
mov dword [ebp - 4], ebx
push dword [0x477fc8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x409662
cmp eax, 0x80
jne 0x40966e
mov eax, dword [0x477fc8]
cmp eax, ebx
je 0x40966e
mov dword [ebp - 0x10], eax
mov eax, dword [0x47777c]
cmp eax, ebx
jne 0x40967c
mov eax, 0x46c12a
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
push 0x46c128
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004054e9
add esp, 0x24
mov ecx, eax
mov edi, 0x47777c
mov byte [ebp - 4], 1
call fcn.0040138b
mov byte [ebp - 4], bl
mov esi, dword [ebp - 0x14]
cmp esi, ebx
je 0x4096b5
call fcn.00401000
cmp dword [ebp - 0x10], ebx
je 0x4096c3
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.004604d2
ret

Function at 0x4096c9
Capabilities:
Set registry value

Disassembly:
push 0x10
mov eax, 0x4645eb
call fcn.00460433
xor ebx, ebx
mov dword [ebp - 0x14], ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.17359E5B_8556_43DD_85BD_96B97448DCAE
lea eax, [ebp - 0x1c]
push str.Software_
push eax
mov dword [ebp - 4], ebx
call fcn.004054e9
mov eax, dword [eax]
add esp, 0x24
lea ecx, [ebp - 0x14]
push ecx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov esi, dword [ebp - 0x18]
test eax, eax
setne byte [ebp - 0xd]
cmp esi, ebx
je 0x40971d
call fcn.00401000
cmp byte [ebp - 0xd], bl
je 0x409734
cmp dword [ebp - 0x14], ebx
je 0x409730
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x409769
mov eax, dword [ebp + 8]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40973a
sub eax, esi
inc eax
push eax
push dword [ebp + 8]
push 1
push ebx
push str.InstStatus
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp dword [ebp - 0x14], ebx
je 0x409767
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
call fcn.004604d2
ret
Function at 0x409993
Capabilities:
Create shortcut via ishelllink

Disassembly:
push 0x18
mov eax, 0x4645c8
call fcn.00460433
xor ebx, ebx
push ebx
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0xe], bl
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x14]
push eax
push 0x465340
xor esi, esi
inc esi
push esi
push ebx
push 0x465360
mov dword [ebp - 4], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jl 0x409aa8
mov dword [ebp - 0x18], ebx
push dword [ebp + 8]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
cmp dword [ebp + 0x10], ebx
je 0x4099fa
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ebx
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
lea edx, [ebp - 0x18]
push edx
push 0x465350
push eax
call dword [ecx]
cmp eax, ebx
jl 0x409a46
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x46c12a
push dword [ebp + 0xc]
lea eax, [ebp - 0x24]
push eax
call fcn.004054e9
mov ebx, dword [eax]
add esp, 0x24
mov dword [ebp - 0x1c], esi
call fcn.00405944
cmp eax, 2
jne 0x409a44
test edx, edx
jne 0x409a44
mov byte [ebp - 0xd], 1
xor ebx, ebx
jmp 0x409a49
xor ebx, ebx
mov byte [ebp - 0xd], bl
test byte [ebp - 0x1c], 1
je 0x409a5b
mov esi, dword [ebp - 0x20]
cmp esi, ebx
je 0x409a5b
call fcn.00401000
cmp byte [ebp - 0xd], bl
je 0x409a98
push dword [ebp + 0xc]
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x24]
push eax
call fcn.00405800
pop ecx
pop ecx
mov byte [ebp - 4], 2
mov eax, dword [eax]
mov ecx, dword [esi]
push 1
push eax
push esi
call dword [ecx + 0x18]
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x20]
mov edi, eax
cmp esi, ebx
je 0x409a92
call fcn.00401000
cmp edi, ebx
setge byte [ebp - 0xe]
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x409aa8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x409abf
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, byte [ebp - 0xe]
call fcn.004604d2
ret
Function at 0x409ac8
Capabilities:
Write file on windows

Disassembly:
push 0x40
mov eax, 0x46458b
call fcn.0046049c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
mov edi, ecx
push 0x46c12a
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x3c]
push edi
push eax
call fcn.004054e9
mov ebx, dword [eax]
add esp, 0x24
call fcn.00405944
xor ebx, ebx
cmp eax, 2
jne 0x409b0b
cmp edx, ebx
je 0x409b11
mov byte [ebp - 0x29], 1
jmp 0x409b14
mov byte [ebp - 0x29], bl
mov esi, dword [ebp - 0x38]
cmp esi, ebx
je 0x409b20
call fcn.00401000
cmp byte [ebp - 0x29], bl
je 0x409b2d
xor al, al
call fcn.004604e6
ret
push 0x46b81c
push edi
call fcn.00450b6d
pop ecx
pop ecx
mov dword [ebp - 0x38], eax
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x409b25
xor eax, eax
mov byte [ebp - 0x28], bl
lea edi, [ebp - 0x27]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, 0x46b8b0
cmp dword [ebp - 0x30], ebx
je 0x409b9f
push ebx
lea eax, [ebp - 0x28]
push 0x46c15c
push eax
call fcn.00450312
add esp, 0xc
push ebx
push ebx
push ebx
push esi
lea eax, [ebp - 0x28]
push eax
push str._r_nIconIndex
push dword [ebp - 0x30]
lea eax, [ebp - 0x4c]
push str.IconFile
push eax
call fcn.004054e9
add esp, 0x24
mov byte [ebp - 4], 1
mov eax, dword [eax]
mov dword [ebp - 0x34], 1
jmp 0x409ba1
xor eax, eax
push ebx
push ebx
push ebx
push ebx
push eax
push esi
push str.http:__www.toparcadehits.com_
lea eax, [ebp - 0x44]
push str._InternetShortcut__r_nURL
push eax
call fcn.004054e9
add esp, 0x24
mov dword [ebp - 4], 3
test byte [ebp - 0x34], 1
je 0x409bd6
mov esi, dword [ebp - 0x48]
cmp esi, ebx
je 0x409bd6
call fcn.00401000
mov eax, dword [ebp - 0x44]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x409bdc
push dword [ebp - 0x38]
sub eax, edx
mov esi, eax
push esi
push 1
push dword [ebp - 0x44]
call fcn.00450f42
add esp, 0x10
mov byte [ebp - 4], bl
cmp esi, eax
mov esi, dword [ebp - 0x40]
je 0x409c1b
cmp esi, ebx
je 0x409c0b
call fcn.00401000
push dword [ebp - 0x38]
call fcn.00451328
pop ecx
mov al, bl
jmp 0x409b27
cmp esi, ebx
je 0x409c24
call fcn.00401000
mov bl, 1
jmp 0x409c0b