joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412710
Capabilities:
Check for peb ntglobalflag flag
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50e5c7
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5524b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0
push 0
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.00414d50
mov dword [edi], eax
lea esi, [edi + 8]
mov dword [ebp - 4], 0
push 0
push 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00414d50
mov dword [esi], eax
lea esi, [edi + 0x10]
mov byte [ebp - 4], 1
push 0
push 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00414d50
mov dword [esi], eax
lea esi, [edi + 0x18]
mov byte [ebp - 4], 2
push 0
push 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00414d50
mov dword [esi], eax
lea esi, [edi + 0x20]
mov byte [ebp - 4], 3
push 0
push 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00414d50
mov dword [esi], eax
lea esi, [edi + 0x28]
mov byte [ebp - 4], 4
push 0
push 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00414d50
mov dword [esi], eax
lea esi, [edi + 0x30]
mov byte [ebp - 4], 5
push 0
push 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00414d50
mov dword [esi], eax
lea esi, [edi + 0x38]
mov byte [ebp - 4], 6
push 0
push 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00414d50
mov dword [esi], eax
lea esi, [edi + 0x40]
mov byte [ebp - 4], 7
mov dword [ebp - 0x14], esi
mov dword [esi], 0
push 0
push 0
mov dword [esi + 4], 0
call fcn.00414d50
mov dword [esi], eax
lea esi, [edi + 0x48]
mov byte [ebp - 4], 8
push 0
push 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00414d50
mov dword [esi], eax
lea esi, [edi + 0x50]
mov byte [ebp - 4], 9
push 0
push 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00414d50
mov dword [esi], eax
lea esi, [edi + 0x58]
mov byte [ebp - 4], 0xa
push 0
push 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00414d50
mov dword [esi], eax
lea esi, [edi + 0x60]
mov byte [ebp - 4], 0xb
push 0
push 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00414d50
mov dword [esi], eax
lea esi, [edi + 0x68]
mov byte [ebp - 4], 0xc
push 0
push 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00414d50
mov dword [esi], eax
lea esi, [edi + 0x70]
mov byte [ebp - 4], 0xd
push 0
push 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00414d50
mov dword [esi], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x412fe0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5524b4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov esi, dword [eax]
cmp esi, eax
je 0x4130a0
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
nop dword [eax + eax]
cmp dword [esi + 0x1c], 0x10
lea ecx, [esi + 8]
jb 0x41301b
mov ecx, dword [ecx]
sub esp, 0x18
mov eax, esp
push ecx
push eax
call fcn.00402620
add esp, 8
lea ecx, [ebp - 0x20]
call fcn.00415dc0
add esp, 0x18
lea eax, [ebp - 0x20]
cmp dword [ebp - 0xc], 8
cmovae eax, dword [ebp - 0x20]
push eax
call ebx
test eax, eax
mov eax, dword [ebp - 0xc]
je 0x4130b5
cmp eax, 8
jb 0x413096
mov ecx, dword [ebp - 0x20]
inc eax
cmp eax, 0x7fffffff
ja 0x413106
add eax, eax
cmp eax, 0x1000
jb 0x41308d
test cl, 0x1f
jne 0x413106
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x413106
sub ecx, eax
cmp ecx, 4
jb 0x413106
cmp ecx, 0x23
ja 0x413106
mov ecx, eax
push ecx
call fcn.0048114c
add esp, 4
mov esi, dword [esi]
cmp esi, dword [edi]
jne 0x413010
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004a4bd0
mov esp, ebp
pop ebp
ret 4
cmp eax, 8
jb 0x4130f1
mov ecx, dword [ebp - 0x20]
inc eax
cmp eax, 0x7fffffff
ja 0x413106
add eax, eax
cmp eax, 0x1000
jb 0x4130e8
test cl, 0x1f
jne 0x41310b
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x413110
sub ecx, eax
cmp ecx, 4
jb 0x413115
cmp ecx, 0x23
ja 0x41311a
mov ecx, eax
push ecx
call fcn.0048114c
add esp, 4
mov ecx, dword [ebp - 8]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a4bd0
mov esp, ebp
pop ebp
ret 4
call fcn.004af061
call fcn.004af061
call fcn.004af061
call fcn.004af061
call fcn.004af061
int3
Function at 0x413120
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5524b4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov esi, dword [eax]
cmp esi, eax
je 0x4131e0
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
nop dword [eax + eax]
cmp dword [esi + 0x1c], 0x10
lea ecx, [esi + 8]
jb 0x41315b
mov ecx, dword [ecx]
sub esp, 0x18
mov eax, esp
push ecx
push eax
call fcn.00402620
add esp, 8
lea ecx, [ebp - 0x20]
call fcn.00415dc0
add esp, 0x18
lea eax, [ebp - 0x20]
cmp dword [ebp - 0xc], 8
cmovae eax, dword [ebp - 0x20]
push eax
call ebx
test eax, eax
mov eax, dword [ebp - 0xc]
jne 0x4131f5
cmp eax, 8
jb 0x4131d6
mov ecx, dword [ebp - 0x20]
inc eax
cmp eax, 0x7fffffff
ja 0x413246
add eax, eax
cmp eax, 0x1000
jb 0x4131cd
test cl, 0x1f
jne 0x413246
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x413246
sub ecx, eax
cmp ecx, 4
jb 0x413246
cmp ecx, 0x23
ja 0x413246
mov ecx, eax
push ecx
call fcn.0048114c
add esp, 4
mov esi, dword [esi]
cmp esi, dword [edi]
jne 0x413150
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004a4bd0
mov esp, ebp
pop ebp
ret 4
cmp eax, 8
jb 0x413231
mov ecx, dword [ebp - 0x20]
inc eax
cmp eax, 0x7fffffff
ja 0x413246
add eax, eax
cmp eax, 0x1000
jb 0x413228
test cl, 0x1f
jne 0x41324b
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x413250
sub ecx, eax
cmp ecx, 4
jb 0x413255
cmp ecx, 0x23
ja 0x41325a
mov ecx, eax
push ecx
call fcn.0048114c
add esp, 4
mov ecx, dword [ebp - 8]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a4bd0
mov esp, ebp
pop ebp
ret 4
call fcn.004af061
call fcn.004af061
call fcn.004af061
call fcn.004af061
call fcn.004af061
int3
Function at 0x418b00
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
jmp 0x418b18
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x100
jae 0x418b6b
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
jmp 0x418b39
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 8
jae 0x418b5c
mov eax, dword [ebp - 8]
shr eax, 1
mov ecx, dword [ebp - 8]
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
xor eax, ecx
mov dword [ebp - 8], eax
jmp 0x418b30
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [edx*4 + 0x554a48], eax
jmp 0x418b0f
jmp 0x418b76
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x800
jae 0x418bae
mov edx, dword [ebp - 4]
mov eax, dword [edx*4 + 0x554648]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
and ecx, 0xff
mov edx, dword [ebp - 0x10]
shr edx, 8
xor edx, dword [ecx*4 + 0x554a48]
mov eax, dword [ebp - 4]
mov dword [eax*4 + 0x554a48], edx
jmp 0x418b6d
mov dword [0x556a48], fcn.0041dd00
call fcn.00418fe0
test eax, eax
jne 0x418bcb
mov dword [0x556a48], 0x41de10
mov esp, ebp
pop ebp
ret

Function at 0x418cc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jne 0x418cd6
xor eax, eax
jmp 0x418d0f
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 0xc]
push edx
call fcn.004b2b6f
add esp, 0x10
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
cmp eax, dword [ebp - 4]
jne 0x418d01
xor eax, eax
jmp 0x418d0f
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call fcn.004b276b
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x418d20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jne 0x418d36
xor eax, eax
jmp 0x418d6f
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 0xc]
push edx
call fcn.004b3730
add esp, 0x10
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
cmp eax, dword [ebp - 4]
jne 0x418d61
xor eax, eax
jmp 0x418d6f
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call fcn.004b276b
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x424b60
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x5524b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x218], eax
mov ecx, dword [ebp - 0x218]
add ecx, 2
mov dword [ebp - 0x22c], ecx
mov edx, dword [ebp - 0x218]
mov ax, word [edx]
mov word [ebp - 0x21a], ax
add dword [ebp - 0x218], 2
cmp word [ebp - 0x21a], 0
jne 0x424b8b
mov ecx, dword [ebp - 0x218]
sub ecx, dword [ebp - 0x22c]
sar ecx, 1
mov dword [ebp - 0x230], ecx
mov edx, dword [ebp - 0x230]
mov dword [ebp - 0x224], edx
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.004ab2f0
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x224]
add eax, 1
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004af13d
add esp, 0xc
mov byte [ebp - 0x20d], 1
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x234], 0
jmp 0x424c34
mov edx, dword [ebp - 0x214]
add edx, 1
mov dword [ebp - 0x214], edx
mov eax, dword [ebp - 0x214]
cmp eax, dword [ebp - 0x224]
jg 0x424cf9
mov ecx, dword [ebp - 0x214]
movzx edx, word [ebp + ecx*2 - 0x20c]
cmp edx, 0x5c
jne 0x424cf4
mov eax, dword [ebp - 0x214]
mov cx, word [ebp + eax*2 - 0x20c]
mov word [ebp - 0x220], cx
mov edx, dword [ebp - 0x214]
shl edx, 1
mov dword [ebp - 0x228], edx
cmp dword [ebp - 0x228], 0x208
jae 0x424c8e
jmp 0x424c93
call fcn.004a489f
xor eax, eax
mov ecx, dword [ebp - 0x228]
mov word [ebp + ecx - 0x20c], ax
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x424cd0
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x424cd0
mov byte [ebp - 0x20d], 0
jmp 0x424cf9
mov ecx, dword [ebp - 0x214]
mov dx, word [ebp - 0x220]
mov word [ebp + ecx*2 - 0x20c], dx
mov eax, dword [ebp - 0x214]
add eax, 1
mov dword [ebp - 0x234], eax
jmp 0x424c25
movzx eax, byte [ebp - 0x20d]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a4bd0
mov esp, ebp
pop ebp
ret
Function at 0x424d10
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x5524b4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x517984
mov eax, dword [ebp + 8]
push eax
call fcn.004252b0
add esp, 8
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
je 0x424d56
push 5
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x424e67
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x210], 0
mov edx, 1
test edx, edx
je 0x424e59
mov dword [ebp - 0x214], 1
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.004ab2f0
add esp, 0xc
cmp dword [ebp - 0x210], 0
jne 0x424dc3
mov edx, dword [ebp + 8]
push edx
push 0x517990
lea eax, [ebp - 0x20c]
push eax
call fcn.00424fa0
add esp, 0xc
jmp 0x424de2
mov ecx, dword [ebp - 0x210]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x5179a0
lea eax, [ebp - 0x20c]
push eax
call fcn.00424fa0
add esp, 0x10
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x424e06
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x424e2e
cmp dword [ebp - 0x210], 0xa
jl 0x424e1a
jmp 0x424e67
mov eax, dword [ebp - 0x210]
add eax, 1
mov dword [ebp - 0x210], eax
jmp 0x424d6a
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004af1b1
add esp, 8
push 5
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x424e67
push 5
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a4bd0
mov esp, ebp
pop ebp
ret
Function at 0x4276b0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xff8
mov eax, dword [0x5524b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x7d0
lea eax, [ebp - 0xfa4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ecx, 0x17
mov esi, str.Program_FilesInternet_Exploreriexplore.exe
lea edi, [ebp - 0xf98]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xfa8], ecx
mov edx, dword [ebp - 0xfa8]
mov dword [ebp - 0xfb4], edx
mov eax, dword [ebp - 0xfa8]
mov cx, word [eax]
mov word [ebp - 0xfae], cx
add dword [ebp - 0xfa8], 2
cmp word [ebp - 0xfae], 0
jne 0x427700
mov edx, dword [ebp - 0xfa8]
sub edx, dword [ebp - 0xfb4]
mov eax, dword [ebp - 0xfb4]
mov dword [ebp - 0xfb8], eax
mov dword [ebp - 0xfbc], edx
lea ecx, [ebp - 0xfa4]
add ecx, 0xfffffffe
mov dword [ebp - 0xfac], ecx
mov edx, dword [ebp - 0xfac]
mov ax, word [edx + 2]
mov word [ebp - 0xfb0], ax
add dword [ebp - 0xfac], 2
cmp word [ebp - 0xfb0], 0
jne 0x42774e
mov edi, dword [ebp - 0xfac]
mov esi, dword [ebp - 0xfb8]
mov edx, dword [ebp - 0xfbc]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x3c
push 0
lea eax, [ebp - 0xff8]
push eax
call fcn.004ab2f0
add esp, 0xc
mov dword [ebp - 0xfec], 0x517db8
mov dword [ebp - 0xff4], 0x200
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xfe4], ecx
mov dword [ebp - 0xfdc], 1
push 1
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 0x517dc4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x4277f5
lea eax, [ebp - 0xfa4]
push eax
call fcn.004281c0
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a4bd0
mov esp, ebp
pop ebp
ret
Function at 0x427840
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
mov eax, dword [0x5524b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x430], 0
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.004ab2f0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x414], dx
push 0x206
push 0
lea eax, [ebp - 0x412]
push eax
call fcn.004ab2f0
add esp, 0xc
mov dword [ebp - 0x444], 0x104
mov dword [ebp - 0x448], 1
lea ecx, [ebp - 0x42c]
push ecx
push 0x20019
push 0
push 0x517c48
push accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
je 0x42791f
xor eax, eax
jmp 0x427a85
lea edx, [ebp - 0x424]
push edx
push 0x20019
push 0
push 0x517c54
mov eax, dword [ebp - 0x42c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
je 0x427955
xor eax, eax
jmp 0x427a85
lea ecx, [ebp - 0x428]
push ecx
push 0x20019
push 0
push 0x517c60
mov edx, dword [ebp - 0x424]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
je 0x42798b
xor eax, eax
jmp 0x427a85
mov dword [ebp - 0x430], 0x104
mov dword [ebp - 0x434], 1
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x434]
push edx
push 0
push 0x517c7c
mov eax, dword [ebp - 0x428]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x424]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x428]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x20c]
push eax
call fcn.004b409b
add esp, 4
mov dword [ebp - 0x420], eax
push 0x517c80
mov ecx, dword [ebp - 0x420]
push ecx
call fcn.004252b0
add esp, 8
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
jne 0x427a1e
xor eax, eax
jmp 0x427a85
mov edx, dword [ebp - 0x41c]
add edx, 2
mov dword [ebp - 0x420], edx
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x438], eax
push 0x517c84
mov ecx, dword [ebp - 0x420]
push ecx
call fcn.004252b0
add esp, 8
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
jne 0x427a60
xor eax, eax
jmp 0x427a85
xor edx, edx
mov eax, dword [ebp - 0x41c]
mov word [eax], dx
mov ecx, dword [ebp - 0x438]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x427a80
xor eax, eax
jmp 0x427a85
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a4bd0
mov esp, ebp
pop ebp
ret
Function at 0x427ca0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0x5524b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x428], 0
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.004ab2f0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x414], dx
push 0x206
push 0
lea eax, [ebp - 0x412]
push eax
call fcn.004ab2f0
add esp, 0xc
mov dword [ebp - 0x440], 0x104
mov dword [ebp - 0x444], 1
lea ecx, [ebp - 0x424]
push ecx
push 0x20019
push 0
push str.htmlfile
push accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
je 0x427d7f
xor eax, eax
jmp 0x427e82
lea edx, [ebp - 0x41c]
push edx
push 0x20019
push 0
push str.shell
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
je 0x427db5
xor eax, eax
jmp 0x427e82
lea ecx, [ebp - 0x420]
push ecx
push 0x20019
push 0
push str.opencommand
mov edx, dword [ebp - 0x41c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
je 0x427deb
xor eax, eax
jmp 0x427e82
mov dword [ebp - 0x428], 0x104
mov dword [ebp - 0x42c], 1
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x42c]
push edx
push 0
push 0x517d0c
mov eax, dword [ebp - 0x420]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x41c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x420]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x20c]
push eax
call fcn.004b409b
add esp, 4
mov dword [ebp - 0x430], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x430]
push edx
call fcn.004252b0
add esp, 8
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0
jne 0x427e7d
xor eax, eax
jmp 0x427e82
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a4bd0
mov esp, ebp
pop ebp
ret
Function at 0x427ed0
Capabilities:
Check if file exists
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
mov eax, dword [0x5524b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x428], 0
lea eax, [ebp - 0x428]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0
je 0x427f23
xor eax, eax
jmp 0x428119
xor ecx, ecx
mov word [ebp - 0x414], cx
push 0x206
push 0
lea edx, [ebp - 0x412]
push edx
call fcn.004ab2f0
add esp, 0xc
mov dword [ebp - 0x43c], 0x104
mov dword [ebp - 0x440], 1
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x440]
push edx
push 0
push 0x517c04
mov eax, dword [ebp - 0x428]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42809e
mov edx, dword [ebp - 0x428]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.004ab2f0
add esp, 0xc
push 0
push 0x26
lea edx, [ebp - 0x20c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
add eax, 0xfffffffe
mov dword [ebp - 0x41c], eax
mov ecx, dword [ebp - 0x41c]
mov dx, word [ecx + 2]
mov word [ebp - 0x42a], dx
add dword [ebp - 0x41c], 2
cmp word [ebp - 0x42a], 0
jne 0x427fe2
mov edi, dword [ebp - 0x41c]
mov ecx, 0x10
mov esi, str.Internet_Exploreriexplore.exe
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42802e
xor eax, eax
jmp 0x428119
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x430], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x420], edx
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x444], eax
mov ecx, dword [ebp - 0x430]
mov dx, word [ecx]
mov word [ebp - 0x416], dx
mov eax, dword [ebp - 0x420]
mov cx, word [ebp - 0x416]
mov word [eax], cx
mov edx, dword [ebp - 0x430]
add edx, 2
mov dword [ebp - 0x430], edx
mov eax, dword [ebp - 0x420]
add eax, 2
mov dword [ebp - 0x420], eax
cmp word [ebp - 0x416], 0
jne 0x42804f
mov eax, 1
jmp 0x428119
lea ecx, [ebp - 0x414]
mov dword [ebp - 0x434], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x424], edx
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x448], eax
mov ecx, dword [ebp - 0x434]
mov dx, word [ecx]
mov word [ebp - 0x418], dx
mov eax, dword [ebp - 0x424]
mov cx, word [ebp - 0x418]
mov word [eax], cx
mov edx, dword [ebp - 0x434]
add edx, 2
mov dword [ebp - 0x434], edx
mov eax, dword [ebp - 0x424]
add eax, 2
mov dword [ebp - 0x424], eax
cmp word [ebp - 0x418], 0
jne 0x4280bf
mov ecx, dword [ebp - 0x428]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a4bd0
mov esp, ebp
pop ebp
ret
Function at 0x4281c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x5524b4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x44
push 0
lea eax, [ebp - 0x828]
push eax
call fcn.004ab2f0
add esp, 0xc
mov dword [ebp - 0x828], 0x44
xor ecx, ecx
mov dword [ebp - 0x7e4], ecx
mov dword [ebp - 0x7e0], ecx
mov dword [ebp - 0x7dc], ecx
mov dword [ebp - 0x7d8], ecx
mov edx, dword [ebp + 8]
push edx
push 0x517de8
lea eax, [ebp - 0x7d4]
push eax
call fcn.0042c2c0
add esp, 0xc
lea ecx, [ebp - 0x7e4]
push ecx
lea edx, [ebp - 0x828]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x7d4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x428251
jmp 0x42826b
mov ecx, dword [ebp - 0x7e4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x7e0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a4bd0
mov esp, ebp
pop ebp
ret