joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e3a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x509758
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x5645bc]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x68], ecx
mov eax, dword [ebp - 0x68]
cmp dword [eax + 0x3c], 0
je 0x40e3e0
mov ecx, dword [ebp - 0x68]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x40e3ec
mov al, 1
jmp 0x40e58f
mov dword [ebp - 0x10], 8
call fcn.00410af0
push eax
mov eax, dword [ebp - 0x68]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x68]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x3c], eax
call fcn.00410af0
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.00410ad0
add esp, 8
movzx eax, al
test eax, eax
je 0x40e42f
xor al, al
jmp 0x40e58f
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.0040d640
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x34]
call fcn.0040d6f0
mov ecx, eax
call fcn.0040da90
mov esi, eax
lea ecx, [ebp - 0x34]
call fcn.00401c80
add esi, eax
push esi
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x34]
call fcn.0040d6f0
mov ecx, eax
call fcn.0040da90
push eax
mov ecx, dword [ebp - 0x68]
add ecx, 0x44
push ecx
mov edx, dword [ebp - 0x68]
mov ecx, dword [edx + 0x3c]
call fcn.0040f000
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x40e4aa
cmp dword [ebp - 0x6c], 1
je 0x40e4b1
cmp dword [ebp - 0x6c], 3
je 0x40e54b
jmp 0x40e563
mov eax, dword [ebp - 0x68]
mov byte [eax + 0x41], 0
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x34]
call fcn.0040d6f0
mov ecx, eax
call fcn.0040da90
mov edx, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x40e514
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x34]
call fcn.0040d6f0
mov ecx, eax
call fcn.0040da90
push eax
call fcn.00465eab
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x40e514
mov byte [ebp - 0x61], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401c50
mov al, byte [ebp - 0x61]
jmp 0x40e58f
mov ecx, dword [ebp - 0x68]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x40e537
mov byte [ebp - 0x62], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401c50
mov al, byte [ebp - 0x62]
jmp 0x40e58f
cmp dword [ebp - 0x38], 0
jne 0x40e549
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.0040d680
jmp 0x40e57b
mov byte [ebp - 0x63], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401c50
mov al, byte [ebp - 0x63]
jmp 0x40e58f
mov byte [ebp - 0x64], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00401c50
mov al, byte [ebp - 0x64]
jmp 0x40e58f
jmp 0x40e442
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00463ee8
mov esp, ebp
pop ebp
ret
Function at 0x412ac0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x509acb
mov eax, dword fs:[0]
push eax
sub esp, 0x474
mov eax, dword [0x5645bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x480], ecx
cmp dword [ebp + 8], 0
jne 0x412afe
xor eax, eax
jmp 0x412cb8
mov byte [ebp - 0x214], 0
push 0xff
push 0
lea eax, [ebp - 0x213]
push eax
call fcn.00463f00
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x214]
push edx
call fcn.00465aa0
add esp, 8
mov dword [ebp - 0x218], 0
mov eax, dword [ebp + 8]
push eax
call fcn.00464310
add esp, 4
mov dword [ebp - 0x474], eax
lea ecx, [ebp - 0x470]
call fcn.00413730
mov dword [ebp - 4], 0
mov byte [ebp - 0x114], 0
push 0xff
push 0
lea ecx, [ebp - 0x113]
push ecx
call fcn.00463f00
add esp, 0xc
mov edx, dword [ebp - 0x474]
movsx eax, byte [ebp + edx - 0x215]
cmp eax, 0x5c
je 0x412b9a
mov ecx, dword [ebp - 0x474]
mov byte [ebp + ecx - 0x214], 0x5c
mov edx, dword [ebp - 0x218]
movsx eax, byte [ebp + edx - 0x214]
test eax, eax
je 0x412c96
mov ecx, dword [ebp - 0x218]
movsx edx, byte [ebp + ecx - 0x214]
cmp edx, 0x3a
jne 0x412bd4
mov eax, dword [ebp - 0x218]
add eax, 2
mov dword [ebp - 0x218], eax
jmp 0x412b9a
mov ecx, dword [ebp - 0x218]
movsx edx, byte [ebp + ecx - 0x214]
cmp edx, 0x5c
jne 0x412c82
mov eax, dword [ebp - 0x218]
push eax
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x114]
push edx
call fcn.004669d0
add esp, 0xc
mov eax, dword [ebp - 0x218]
mov byte [ebp + eax - 0x114], 0
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x470]
call fcn.00413770
lea edx, [ebp - 0x46c]
push edx
lea ecx, [ebp - 0x470]
call fcn.0042e2c0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x412c82
push 0
lea ecx, [ebp - 0x470]
call fcn.0042e2c0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x412c82
mov dword [ebp - 0x478], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x470]
call fcn.00413750
mov eax, dword [ebp - 0x478]
jmp 0x412cb8
mov eax, dword [ebp - 0x218]
add eax, 1
mov dword [ebp - 0x218], eax
jmp 0x412b9a
mov dword [ebp - 0x47c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x470]
call fcn.00413750
mov eax, dword [ebp - 0x47c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00463ee8
mov esp, ebp
pop ebp
ret 4
Function at 0x416880
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x5135dc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0
jne 0x4168a6
xor eax, eax
jmp 0x41696c
push str.GetNativeSystemInfo
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
push str.IsWow64Process
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
push str.Wow64DisableWow64FsRedirection
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
push 0x51363c
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
push str.GetSystemWow64DirectoryW
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
jne 0x416937
xor eax, eax
jmp 0x41696c
push 0x513694
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], eax
push str.Wow64RevertWow64FsRedirection
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x418c70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50a012
mov eax, dword fs:[0]
push eax
sub esp, 0x290
mov eax, dword [0x5645bc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x288], ecx
mov eax, dword [ebp - 0x288]
mov cl, byte [eax + 0x25]
mov byte [ebp - 0x23e], cl
mov edx, dword [ebp - 0x288]
mov al, byte [edx + 0x24]
mov byte [ebp - 0x23d], al
push str.0025
lea ecx, [ebp - 0x30]
call fcn.00401c90
mov dword [ebp - 4], 0
mov word [ebp - 0x23c], 0
push 0x206
push 0
lea ecx, [ebp - 0x23a]
push ecx
call fcn.00463f00
add esp, 0xc
push 0x104
lea edx, [ebp - 0x23c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x25c]
call fcn.00401c90
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x278]
push ecx
call fcn.00410430
mov ecx, eax
call fcn.00409bf0
mov dword [ebp - 0x28c], eax
mov edx, dword [ebp - 0x28c]
mov dword [ebp - 0x290], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x290]
push eax
lea ecx, [ebp - 0x30]
call fcn.00403a70
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x278]
call fcn.00401cd0
push 0x1034
call fcn.0045ac81
add esp, 4
mov dword [ebp - 0x280], eax
mov byte [ebp - 4], 3
cmp dword [ebp - 0x280], 0
je 0x418dee
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0x288]
mov al, byte [edx + 0x27]
push eax
mov ecx, dword [ebp - 0x288]
mov dl, byte [ecx + 0x26]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x284], esp
lea eax, [ebp - 0x30]
push eax
call fcn.00403a40
mov dword [ebp - 0x294], eax
mov cl, byte [ebp - 0x23e]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x288]
push edx
mov ecx, dword [ebp - 0x280]
call fcn.00422ca0
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x29c], eax
jmp 0x418df8
mov dword [ebp - 0x29c], 0
mov ecx, dword [ebp - 0x29c]
mov dword [ebp - 0x27c], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x27c]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x288]
add eax, 0x1c
push eax
push 0
mov ecx, dword [ebp - 0x10]
push ecx
push 0x418e80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x288]
mov dword [edx + 0x20], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x25c]
call fcn.00401cd0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00401cd0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00463ee8
mov esp, ebp
pop ebp
ret 0x10
Function at 0x423f40
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x5645bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x220], ecx
mov eax, dword [0x567154]
push eax
call dword [0x53a0a8]
add esp, 4
push str.Riched20.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x21c], eax
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
mov ecx, dword [0x567154]
push ecx
call fcn.00457530
add esp, 4
push 0
mov edx, dword [0x567154]
push edx
push 0
mov ecx, 0x56778c
call fcn.00425f80
push 1
call fcn.004175b0
mov ecx, eax
call fcn.00417470
mov byte [ebp - 0x215], 0
push 0x514d84
mov ecx, dword [ebp - 0x220]
call fcn.00401e80
push eax
call fcn.0046719d
add esp, 8
test eax, eax
jne 0x423fe8
mov byte [ebp - 0x215], 0
jmp 0x423fef
mov byte [ebp - 0x215], 1
mov al, byte [ebp - 0x215]
push eax
call fcn.004175b0
mov ecx, eax
call fcn.00417450
call fcn.004175b0
mov dword [ebp - 0x224], eax
mov ecx, dword [ebp - 0x224]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x224]
mov eax, dword [edx + 0x8c]
call eax
mov dword [ebp - 0x214], 0x100
mov word [ebp - 0x210], 0
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00463f00
add esp, 0xc
push 0x514d8c
push 0x514da8
lea edx, [ebp - 0x210]
push edx
call fcn.00466ebb
add esp, 0xc
push 0
push 0x320
push 0x258
push 0
push 0
mov eax, dword [ebp - 0x214]
push eax
push 0x10ce0000
lea ecx, [ebp - 0x210]
push ecx
push 0
call fcn.004175b0
mov ecx, eax
call dword [0x53a07c]
call fcn.004175b0
mov ecx, eax
call dword [0x53a098]
push 5
call fcn.004175b0
mov ecx, eax
call dword [0x53a080]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [0x53a0a4]
call dword [0x53a0a0]
mov ecx, 0x56778c
call fcn.00426030
call dword [sym.imp.ole32.dll_OleUninitialize]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00463ee8
mov esp, ebp
pop ebp
ret
Function at 0x425da0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x5645bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x220], ecx
mov eax, dword [0x567154]
push eax
call dword [0x53a0a8]
add esp, 4
push 0x51509c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x21c], eax
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
mov ecx, dword [0x567154]
push ecx
call fcn.00457530
add esp, 4
push 0
mov edx, dword [0x567154]
push edx
push 0
mov ecx, 0x56778c
call fcn.00425f80
call fcn.004175b0
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x224]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x224]
mov eax, dword [edx + 0x8c]
call eax
mov byte [ebp - 0x215], 0
push 0x5150b8
mov ecx, dword [ebp - 0x220]
call fcn.00401e80
push eax
call fcn.0046719d
add esp, 8
test eax, eax
jne 0x425e5b
mov byte [ebp - 0x215], 0
jmp 0x425e62
mov byte [ebp - 0x215], 1
mov cl, byte [ebp - 0x215]
push ecx
call fcn.004175b0
mov ecx, eax
call fcn.00417450
mov dl, byte [ebp - 0x215]
push edx
call fcn.004175b0
mov ecx, eax
call fcn.00417450
mov dword [ebp - 0x214], 0x100
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00463f00
add esp, 0xc
push 0x5150c0
push str._s__
lea ecx, [ebp - 0x210]
push ecx
call fcn.00466ebb
add esp, 0xc
push 0
push 0x320
push 0x258
push 0
push 0
mov edx, dword [ebp - 0x214]
push edx
push 0x10ce0000
lea eax, [ebp - 0x210]
push eax
push 0
call fcn.004175b0
mov ecx, eax
call dword [0x53a07c]
push 0
call fcn.004175b0
mov ecx, eax
call dword [0x53a080]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.004175b0
mov ecx, eax
call dword [0x53a098]
call dword [0x53a0a4]
call dword [0x53a0a0]
mov ecx, 0x56778c
call fcn.00426030
call dword [sym.imp.ole32.dll_OleUninitialize]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00463ee8
mov esp, ebp
pop ebp
ret
Function at 0x42cec0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x5645bc]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x228], ecx
lea ecx, [ebp - 0x10]
call fcn.0042ccd0
push 0x2001f
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x228]
mov edx, dword [ecx]
push edx
lea ecx, [ebp - 0x10]
call fcn.0042ce70
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42cf20
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x21c], eax
lea ecx, [ebp - 0x10]
call fcn.0042ccf0
mov eax, dword [ebp - 0x21c]
jmp 0x42cfb1
mov dword [ebp - 4], 0x100
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
push 0
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x218]
push eax
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x42cf86
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x10]
call fcn.0042cec0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42cf7d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x220], eax
lea ecx, [ebp - 0x10]
call fcn.0042ccf0
mov eax, dword [ebp - 0x220]
jmp 0x42cfb1
mov dword [ebp - 4], 0x100
jmp 0x42cf27
lea ecx, [ebp - 0x10]
call fcn.0042cdc0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x228]
call fcn.0042cd60
mov dword [ebp - 0x224], eax
lea ecx, [ebp - 0x10]
call fcn.0042ccf0
mov eax, dword [ebp - 0x224]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00463ee8
mov esp, ebp
pop ebp
ret 4
Function at 0x42d5b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0x42d5b9
xor ecx, ecx
cmp dword [ebp + 0xc], 0
setne cl
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
jne 0x42d5d9
push 0x80004005
call fcn.004138a0
xor edx, edx
jne 0x42d5bd
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
lea ecx, [eax + edx*2]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
lea ecx, [eax + edx*2]
mov dword [ebp - 4], ecx
cmp dword [ebp - 0xc], 1
jne 0x42d5ea
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 7
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8
Function at 0x437eb0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
push eax
call fcn.00464297
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 1
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0045acac
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.00465d5f
add esp, 8
mov byte [ebp - 1], 1
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
jmp 0x437f1a
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 8]
jg 0x437f88
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax + edx*2]
cmp ecx, 0x5c
jne 0x437f86
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov cx, word [eax + edx*2]
mov word [ebp - 0x18], cx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov word [eax + edx*2], 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x437f6f
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x437f6f
mov byte [ebp - 1], 0
jmp 0x437f88
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dx, word [ebp - 0x18]
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x437f11
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.004e0b6b
add esp, 4
movzx eax, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x439a10
Capabilities:
Check if file exists
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x5645bc]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x439a55
xor eax, eax
jmp 0x439b54
mov word [ebp - 0x220], 0
push 0x206
push 0
lea ecx, [ebp - 0x21e]
push ecx
call fcn.00463f00
add esp, 0xc
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 4], 1
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0x516aac
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x439b32
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov word [ebp - 0x428], 0
push 0x206
push 0
lea edx, [ebp - 0x426]
push edx
call fcn.00463f00
add esp, 0xc
push 0
push 0x26
lea eax, [ebp - 0x428]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.Internet_Exploreriexplore.exe
lea ecx, [ebp - 0x428]
push ecx
call fcn.00465d35
add esp, 8
lea edx, [ebp - 0x428]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x439b18
xor eax, eax
jmp 0x439b54
lea eax, [ebp - 0x428]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00465d5f
add esp, 8
mov eax, 1
jmp 0x439b54
lea edx, [ebp - 0x220]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00465d5f
add esp, 8
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00463ee8
mov esp, ebp
pop ebp
ret
Function at 0x439b70
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x5645bc]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x23c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x228], 0
mov word [ebp - 0x448], 0
push 0x206
push 0
lea eax, [ebp - 0x446]
push eax
call fcn.00463f00
add esp, 0xc
mov word [ebp - 0x220], 0
push 0x206
push 0
lea ecx, [ebp - 0x21e]
push ecx
call fcn.00463f00
add esp, 0xc
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x44c], 1
lea edx, [ebp - 0x10]
push edx
push 0x20019
push 0
push 0x516af0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x439c43
xor eax, eax
jmp 0x439da0
lea eax, [ebp - 0x22c]
push eax
push 0x20019
push 0
push 0x516afc
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x439c76
xor eax, eax
jmp 0x439da0
lea edx, [ebp - 0x234]
push edx
push 0x20019
push 0
push 0x516b08
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x439cac
xor eax, eax
jmp 0x439da0
mov dword [ebp - 0x228], 0x104
mov dword [ebp - 8], 1
lea ecx, [ebp - 0x228]
push ecx
lea edx, [ebp - 0x448]
push edx
lea eax, [ebp - 8]
push eax
push 0
push 0x516b24
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x448]
push ecx
call fcn.00468a99
add esp, 4
mov dword [ebp - 0x224], eax
push 0x516b28
mov edx, dword [ebp - 0x224]
push edx
call fcn.00414260
add esp, 8
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 0
jne 0x439d39
xor eax, eax
jmp 0x439da0
mov eax, dword [ebp - 0x450]
add eax, 2
mov dword [ebp - 0x224], eax
mov ecx, dword [ebp - 0x224]
mov dword [ebp - 0x238], ecx
push 0x516b2c
mov edx, dword [ebp - 0x224]
push edx
call fcn.00414260
add esp, 8
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 0
jne 0x439d7b
xor eax, eax
jmp 0x439da0
mov eax, dword [ebp - 0x450]
mov word [eax], 0
mov ecx, dword [ebp - 0x238]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x439d9b
xor eax, eax
jmp 0x439da0
mov eax, 1
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00463ee8
mov esp, ebp
pop ebp
ret