joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434da0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x5603e8]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call sub.MSVCR100.dll_memset
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x412]
push eax
mov word [ebp - 0x414], dx
call sub.MSVCR100.dll_memset
mov edx, dword [0x565030]
add esp, 0x18
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call dword [sym.imp.MSVCR100.dll_wcsrchr]
xor ecx, ecx
add esp, 8
mov word [eax], cx
xor eax, eax
mov edi, edi
movzx ecx, word [ebp + eax - 0x20c]
mov word [ebp + eax - 0x414], cx
add eax, 2
test cx, cx
jne 0x434e20
push esi
push edi
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x434e43
mov ecx, 7
mov esi, str.cfgsoem.ini
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x414]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x434e64
lea edx, [ebp - 0x20c]
push edx
push 1
mov ecx, 8
mov esi, str.cfgs_setup.ini
push str.SDIMode
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x4cebd0
call esi
test eax, eax
je 0x434ec9
lea eax, [ebp - 0x414]
push eax
push 1
push str.SDIMode
push 0x4cebd0
call esi
test eax, eax
je 0x434ec9
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004b12f6
mov esp, ebp
pop ebp
ret
Function at 0x435580
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0x2001f
xor ebx, ebx
push esi
push edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call fcn.00412570
test eax, eax
je 0x4356a0
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x435616
cmp dword [ebx], 0
je 0x435606
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4355d6
mov eax, 1
jmp 0x435633
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4355cf
mov ecx, dword [ebx]
push 0
push ecx
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 4]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push esi
push edi
call eax
jmp 0x435633
cmp dword [ebx + 4], 0
je 0x4355cf
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 4]
push eax
jmp 0x43561e
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
push 0
push 0x2001f
push 0
push 0
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x435679
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x435645
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 4]
test eax, eax
jne 0x43567c
xor ebx, ebx
mov eax, dword [ebp + 0x10]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
neg edi
sbb edi, edi
and edi, 0x80004005
cmp esi, ebx
je 0x435670
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x435694
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
test esi, esi
je 0x435694
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x14]
jmp 0x43564e
Function at 0x4356b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 2
xor ebx, ebx
push esi
push edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], 0x80004005
call fcn.00412570
test eax, eax
je 0x43577c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x435747
cmp dword [ebx], 0
je 0x435737
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x43570a
mov eax, 1
jmp 0x435761
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x435703
mov ecx, dword [ebx]
push 0
push ecx
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 4]
push ecx
push 0
push 2
push 0
push 0
push 0
push esi
push edi
call eax
jmp 0x435761
cmp dword [ebx + 4], 0
je 0x435703
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 4]
push eax
jmp 0x43574f
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
push 0
push 2
push 0
push 0
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4357c1
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x435773
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 4]
test eax, eax
jne 0x4357c4
jmp 0x43577f
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp + 0x14]
test edi, edi
jne 0x435798
mov eax, 0xd
neg eax
sbb eax, eax
and eax, 0x80004005
mov edi, eax
jmp 0x4357c7
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp + 0x10]
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
and eax, 0x80004005
mov edi, eax
jmp 0x4357c7
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0xc]
test esi, esi
je 0x4357df
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
test esi, esi
je 0x4357df
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x435ec0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x5603e8]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push str.CanIWork
call fcn.00435060
mov ecx, eax
call dword [sym.imp.QtCore4.dll_public:_void____thiscall_QLibrary::resolve_char_const__]
xor edi, edi
cmp eax, edi
je 0x435f21
push str.68_upd
call eax
add esp, 4
test eax, eax
je 0x435f21
call fcn.00435120
test eax, eax
jne 0x435f10
call fcn.004351c0
test eax, eax
je 0x436018
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret
push 0x206
lea ecx, [ebp - 0x20a]
xor eax, eax
push edi
push ecx
mov word [ebp - 0x20c], ax
call sub.MSVCR100.dll_memset
add esp, 0xc
push edi
push 0x26
lea edx, [ebp - 0x20c]
push edx
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.kingsoftksdefkshm.exe
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.MSVCR100.dll_wcscat_s]
add esp, 0xc
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x436018
push esi
push 0x20019
push str.SOFTWAREksdef
push 0x80000002
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x218], edi
mov dword [ebp - 0x210], edi
call fcn.00412570
mov esi, dword [ebp - 0x220]
test eax, eax
jne 0x43600c
lea edx, [ebp - 0x224]
push edx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x214]
push ecx
push edi
push 0x4d1b34
push esi
mov dword [ebp - 0x224], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x43600c
cmp dword [ebp - 0x214], 4
jne 0x43600c
cmp dword [ebp - 0x210], 1
je 0x43600c
lea ecx, [ebp - 0x220]
call fcn.00414440
jmp 0x436017
cmp esi, edi
je 0x436017
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop edi
call fcn.004b12f6
mov esp, ebp
pop ebp
ret
Function at 0x437280
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7bb8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5603e8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov eax, 1
mov dword [ebp - 0x14], ebx
test byte [0x561058], al
jne 0x4372e5
or dword [0x561058], eax
xor eax, eax
push 0x4c3120
mov dword [0x561050], 7
mov dword [0x56104c], ebx
mov word [0x56103c], ax
call fcn.004b13f9
add esp, 4
cmp dword [0x56104c], ebx
jne 0x43736c
lea ecx, [ebp - 0xd]
call fcn.004331f0
mov edi, dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea ecx, [ebp - 0x14]
push ecx
push ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
call edi
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004b0bb6
mov esi, eax
add esp, 4
lea eax, [ebp - 0x14]
push eax
push esi
call edi
test eax, eax
je 0x437351
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x437336
sub eax, edx
sar eax, 1
push eax
push esi
mov ecx, 0x56103c
call fcn.00405660
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0xd], bl
je 0x43736c
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
xor ecx, ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
push ebx
mov word [esi], cx
push 0x56103c
mov ecx, esi
call fcn.00405560
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x438260
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7dab
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x5603e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x561000], 0
je 0x43829c
mov al, 1
jmp 0x438380
lea eax, [ebp - 0xc8]
push eax
call fcn.00437e50
push str.utilityinstall.ini
push eax
lea ecx, [ebp - 0xac]
push ecx
mov dword [ebp - 4], 0
call fcn.0040ca00
add esp, 0x10
cmp dword [ebp - 0xb4], 8
jb 0x4382dc
mov edx, dword [ebp - 0xc8]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
push 0x7e
push eax
lea ecx, [ebp - 0x8e]
push ecx
mov word [ebp - 0x90], ax
call sub.MSVCR100.dll_memset
mov eax, dword [ebp - 0xac]
add esp, 0xc
cmp dword [ebp - 0x98], 8
jae 0x43830c
lea eax, [ebp - 0xac]
push eax
push 0x40
lea edx, [ebp - 0x90]
push edx
push 0x4cfbcc
push str.InstallPerUser
push str.update
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, 0x4c980c
lea eax, [ebp - 0x90]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43835c
test dx, dx
je 0x438358
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43835c
add eax, 4
add ecx, 4
test dx, dx
jne 0x438336
xor eax, eax
jmp 0x438361
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete bl
cmp dword [ebp - 0x98], 8
jb 0x43837e
mov eax, dword [ebp - 0xac]
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret
Function at 0x4383a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7dab
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x5603e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0xc8]
push eax
call fcn.00437e50
push str.utilityinstall.ini
push eax
lea ecx, [ebp - 0xac]
push ecx
mov dword [ebp - 4], 0
call fcn.0040ca00
add esp, 0x10
cmp dword [ebp - 0xb4], 8
jb 0x43840c
mov edx, dword [ebp - 0xc8]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
push 0x7e
push eax
lea ecx, [ebp - 0x8e]
push ecx
mov word [ebp - 0x90], ax
call sub.MSVCR100.dll_memset
mov eax, dword [ebp - 0xac]
add esp, 0xc
cmp dword [ebp - 0x98], 8
jae 0x43843c
lea eax, [ebp - 0xac]
push eax
push 0x40
lea edx, [ebp - 0x90]
push edx
push 0x4c980c
push str.needAdmin
push str.update
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, 0x4c980c
lea eax, [ebp - 0x90]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43848c
test dx, dx
je 0x438488
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43848c
add eax, 4
add ecx, 4
test dx, dx
jne 0x438466
xor eax, eax
jmp 0x438491
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete bl
cmp dword [ebp - 0x98], 8
jb 0x4384ae
mov eax, dword [ebp - 0xac]
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret
Function at 0x438ac0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7e68
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x5603e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x48]
push eax
call fcn.00437e50
push str.wtoolexwpsupdate.exe
push eax
lea ecx, [ebp - 0x2c]
push ecx
mov dword [ebp - 4], 0
call fcn.0040ca00
add esp, 0x10
cmp dword [ebp - 0x34], 8
jb 0x438b1d
mov edx, dword [ebp - 0x48]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x438b29
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
sete cl
cmp dword [ebp - 0x18], 8
mov esi, ecx
jb 0x438b4c
mov edx, dword [ebp - 0x2c]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret
Function at 0x43a860
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b8266
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x5603e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x206
xor edi, edi
lea ecx, [ebp - 0x216]
xor eax, eax
push edi
push ecx
mov word [ebp - 0x218], ax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x104
lea edx, [ebp - 0x218]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
cmp dword [0x55cb5c], 0xffffffff
jne 0x43a90d
push 0x4d17f0
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, edi
je 0x43a905
push 0x55cb5c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
jne 0x43a90d
mov dword [0x55cb5c], edi
jmp 0x43a91a
mov eax, str.qingshellext64.dll
cmp dword [0x55cb5c], edi
jne 0x43a91f
mov eax, str.qingshellext.dll
push eax
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43a948
mov eax, 0x80070002
jmp 0x43aa4c
mov edx, 0x4d1fbc
cmp dword [ebp + 0xc], edi
jne 0x43a957
mov edx, 0x4c79ac
xor eax, eax
mov word [ebp - 0x250], ax
mov eax, edx
mov dword [ebp - 0x23c], 7
mov dword [ebp - 0x240], edi
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x43a975
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x250]
call fcn.00405660
xor ecx, ecx
lea eax, [ebp - 0x218]
mov dword [ebp - 4], edi
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], edi
mov word [ebp - 0x234], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x43a9b6
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x234]
call fcn.00405660
xor eax, eax
cmp dword [ebp + 0xc], edi
lea ecx, [ebp - 0x250]
sete al
lea edx, [ebp - 0x234]
mov byte [ebp - 4], 1
push eax
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
call fcn.00438eb0
add esp, 0x10
cmp dword [ebp - 0x220], 8
mov esi, eax
jb 0x43aa19
mov ecx, dword [ebp - 0x234]
push ecx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
xor edx, edx
cmp dword [ebp - 0x23c], 8
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], edi
mov word [ebp - 0x234], dx
jb 0x43aa4a
mov eax, dword [ebp - 0x250]
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret
Function at 0x43b380
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b83bb
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x5603e8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x428], esi
push 0x206
lea ecx, [ebp - 0x422]
xor eax, eax
push esi
mov ebx, 1
mov dword [ebp - 4], esi
push ecx
mov byte [ebp - 4], bl
mov word [ebp - 0x424], ax
call sub.MSVCR100.dll_memset
push 0x206
lea eax, [ebp - 0x21a]
xor edx, edx
push esi
push eax
mov word [ebp - 0x21c], dx
call sub.MSVCR100.dll_memset
mov eax, 0x104
add esp, 0x18
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x434], eax
test byte [0x56106c], bl
jne 0x43b465
or dword [0x56106c], ebx
mov dword [0x56105c], esi
mov dword [0x561060], esi
mov dword [0x561064], esi
mov byte [ebp - 4], 3
call fcn.00438260
mov ecx, 0x56105c
mov byte [0x561068], al
call fcn.004347b0
push 0x4c30f0
call fcn.004b13f9
add esp, 4
mov byte [ebp - 4], bl
mov ecx, dword [0x56105c]
push 0x2001f
push edi
push ecx
lea ecx, [ebp - 0x430]
call fcn.00412570
test eax, eax
jne 0x43b573
lea edx, [ebp - 0x438]
push edx
push 0x4c79ac
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x430]
call fcn.00417550
cmp eax, esi
jne 0x43b573
test byte [0x56106c], bl
jne 0x43b4f3
or dword [0x56106c], ebx
mov dword [0x56105c], esi
mov dword [0x561060], esi
mov dword [0x561064], esi
mov byte [ebp - 4], 5
call fcn.00438260
mov ecx, 0x56105c
mov byte [0x561068], al
call fcn.004347b0
push 0x4c30f0
call fcn.004b13f9
add esp, 4
mov byte [ebp - 4], bl
mov edx, dword [0x56105c]
push 0x2001f
lea ecx, [ebp - 0x424]
push ecx
push edx
lea ecx, [ebp - 0x430]
call fcn.00412570
test eax, eax
jne 0x43b573
lea eax, [ebp - 0x434]
push eax
push 0x4c79ac
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x430]
call fcn.00417550
cmp eax, esi
jne 0x43b573
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerDiscardablePostSetupShellNew
push 0x80000001
lea ecx, [ebp - 0x430]
call fcn.00412570
test eax, eax
jne 0x43b573
mov eax, dword [ebp - 0x430]
lea edx, [ebp - 0x21c]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x43b573
mov eax, dword [ebp - 0x430]
cmp eax, esi
je 0x43b584
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret
Function at 0x43bdd0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5603e8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov dword [ebp - 0x210], 0xd2
mov word [ebp - 0x20c], ax
call sub.MSVCR100.dll_memset
mov eax, dword [0x565030]
add esp, 0xc
push 0x104
lea edx, [ebp - 0x20c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.MSVCR100.dll_wcsrchr]
lea ecx, [ebp - 0x20c]
push 0x5c
push ecx
call edi
xor edx, edx
mov word [eax], dx
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call edi
add esp, 0x10
test eax, eax
je 0x43be55
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43be60
sub eax, edx
sar eax, 1
mov dword [ebp - 0x214], eax
cmp eax, 0xd2
lea eax, [ebp - 0x214]
jl 0x43be88
lea eax, [ebp - 0x210]
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.MSVCR100.dll_wcsncpy]
add esp, 0xc
lea eax, [esi - 2]
nop
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x43bea0
mov ecx, dword [str.das]
mov dword [eax], ecx
mov edx, dword [0x4d27c0]
mov dword [eax + 4], edx
mov cx, word [0x4d27c4]
push 0
push esi
mov word [eax + 8], cx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp byte [ebp + 0xc], 0
je 0x43bf28
lea eax, [esi - 2]
lea ebx, [ebx]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x43bee0
mov edx, dword [str._allusers]
mov dword [eax], edx
mov ecx, dword [0x4d27ac]
mov dword [eax + 4], ecx
mov edx, dword [0x4d27b0]
mov dword [eax + 8], edx
mov ecx, dword [0x4d27b4]
mov dword [eax + 0xc], ecx
mov edx, dword [0x4d27b8]
pop edi
mov dword [eax + 0x10], edx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret
add esi, 0xfffffffe
jmp 0x43bf30
mov ax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x43bf30
mov eax, dword [str.user]
mov dword [esi], eax
mov ecx, dword [0x4d27a0]
mov dword [esi + 4], ecx
mov edx, dword [0x4d27a4]
mov ecx, dword [ebp - 4]
pop edi
mov dword [esi + 8], edx
xor ecx, ebp
pop esi
call fcn.004b12f6
mov esp, ebp
pop ebp
ret

Function at 0x43bf70
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push eax
push esi
call fcn.0043bdd0
add esp, 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [esi - 2]
pop esi
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x43bf91
mov ecx, dword [str._appdata]
mov dword [eax], ecx
mov edx, dword [0x4d27cc]
mov dword [eax + 4], edx
mov ecx, dword [0x4d27d0]
mov dword [eax + 8], ecx
mov edx, dword [0x4d27d4]
mov dword [eax + 0xc], edx
mov cx, word [0x4d27d8]
mov word [eax + 0x10], cx
pop ebp
ret