joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4553c0
Capabilities:
Check http status code
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5402b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0
push 0
push 0
push 0
xor bl, bl
push 0x51c620
mov byte [ebp - 0x205], bl
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
test edi, edi
jne 0x455408
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c0985
mov esp, ebp
pop ebp
ret
push esi
lea esp, [esp]
push 0
push 0x84000000
push 0
push 0
push str.http:__profile.se.360.cn_proxyerr.php
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov esi, eax
test esi, esi
je 0x4554b1
xor eax, eax
push 0x1fe
push eax
lea ecx, [ebp - 0x202]
push ecx
mov word [ebp - 0x204], ax
call fcn.004c5470
add esp, 0xc
push 0
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x204]
push eax
push 0x13
push esi
mov dword [ebp - 0x20c], 0x100
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x455493
lea ecx, [ebp - 0x204]
push ecx
call fcn.004c2be0
add esp, 4
cmp eax, 0x193
je 0x45549e
cmp eax, 0x197
je 0x45549e
xor bl, bl
mov byte [ebp - 0x205], 1
jmp 0x4554aa
mov eax, esi
call fcn.004553a0
test al, al
setne bl
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
test bl, bl
jne 0x455410
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x205]
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.004c0985
mov esp, ebp
pop ebp
ret

Function at 0x45f350
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ecx
xor edx, edx
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x553e40], ecx
inc edx
cmp edx, 0x100
jb 0x45f353
cmp edx, 0x800
jae 0x45f429
lea ecx, [ecx]
mov eax, dword [edx*4 + 0x553a40]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x553e40]
inc edx
mov dword [edx*4 + 0x553e3c], eax
cmp edx, 0x800
jb 0x45f400
mov dword [0x54e9e0], 0x45f450
call fcn.00462b50
test eax, eax
jne 0x45f446
mov dword [0x54e9e0], 0x45f500
pop ecx
ret
Function at 0x45ff30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [edi]
mov ebx, eax
test esi, esi
je 0x45ff8f
mov dword [edi], 0
jmp 0x45ff50
mov eax, 0x400000
cmp esi, 0x400000
ja 0x45ff5f
mov eax, esi
mov edx, dword [ebp + 8]
push 0
lea ecx, [ebp - 4]
push ecx
push eax
mov eax, dword [edx]
push ebx
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 4]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x45ff97
test ecx, ecx
je 0x45ff8f
test esi, esi
ja 0x45ff50
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4628b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ecx]
and esi, 7
mov dword [ebp - 4], 0
cmp eax, 5
jae 0x4628d2
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
lea edx, [edx + eax - 4]
push ebx
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], edx
push edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
lea edi, [ecx + eax]
cmp edi, edx
jae 0x462901
mov cl, byte [edi]
and cl, 0xfe
cmp cl, 0xe8
je 0x462901
inc edi
cmp edi, edx
jb 0x4628f2
mov ebx, edi
sub ebx, eax
mov eax, ebx
sub eax, dword [ebp - 8]
mov dword [ebp - 4], ebx
cmp edi, edx
jae 0x462a08
cmp eax, 3
jbe 0x462938
xor esi, esi
mov al, byte [edi + 4]
mov dword [ebp - 8], ebx
test al, al
je 0x462975
cmp al, 0xff
je 0x462975
and esi, 3
add esi, esi
or esi, 1
inc ebx
mov dword [ebp - 4], ebx
jmp 0x4628e5
lea ecx, [eax - 1]
shl esi, cl
and esi, 7
je 0x46291c
movzx eax, byte [esi + 0x519398]
mov ecx, edi
sub ecx, eax
cmp byte [esi + 0x519390], 0
mov al, byte [ecx + 4]
je 0x462961
test al, al
je 0x462961
cmp al, 0xff
jne 0x46291c
and esi, 3
add esi, esi
mov dword [ebp - 8], ebx
or esi, 1
inc ebx
mov dword [ebp - 4], ebx
jmp 0x4628e5
movzx ecx, byte [edi + 2]
movzx edx, al
movzx eax, byte [edi + 3]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 1]
shl edx, 8
or edx, ecx
shl edx, 8
or edx, eax
sub edx, ebx
sub edx, 5
mov eax, edx
test esi, esi
je 0x4629d8
movzx edx, byte [esi + 0x519398]
add edx, edx
add edx, edx
add edx, edx
mov ecx, 0x18
sub ecx, edx
mov ebx, eax
shr ebx, cl
test bl, bl
je 0x4629bf
cmp bl, 0xff
jne 0x4629d5
mov ebx, dword [ebp - 4]
mov ecx, 0x20
sub ecx, edx
mov edx, 1
shl edx, cl
dec edx
xor edx, eax
jmp 0x462993
mov ebx, dword [ebp - 4]
mov ecx, eax
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov edx, eax
shr edx, 0x10
mov ecx, eax
shr ecx, 8
add ebx, 5
mov byte [edi + 3], dl
mov edx, dword [ebp - 0xc]
mov byte [edi + 2], cl
mov byte [edi + 1], al
mov dword [ebp - 4], ebx
jmp 0x4628e5
cmp eax, 3
jbe 0x462a1d
mov edx, dword [ebp + 0xc]
pop edi
xor esi, esi
mov eax, ebx
pop ebx
mov dword [edx], esi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
lea ecx, [eax - 1]
shl esi, cl
pop edi
mov eax, ebx
pop ebx
and esi, 7
mov dword [edx], esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x464800
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x46482e
pop esi
lea eax, [ebx + 1]
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
push ebx
lea ecx, [ebp - 4]
push ecx
push edi
push edx
push esi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 4], edi
je 0x46484c
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x465410
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x5402b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x21
call fcn.00409e20
add esp, 4
lea ecx, [ebp - 0x20]
call fcn.00407310
mov eax, dword [ebp - 0x1c]
mov ebx, 8
cmp dword [ebp - 8], ebx
jae 0x465444
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4654a0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 8], ebx
jae 0x46545a
lea eax, [ebp - 0x1c]
push 0xa
push 0
push 0
push eax
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov esi, ecx
cmp dword [ebp - 8], ebx
jb 0x46548e
mov edx, dword [ebp - 0x1c]
push edx
call fcn.004c097a
add esp, 4
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c0985
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0xc], 0xa
jbe 0x46552b
lea ecx, [ebp - 0x3c]
call fcn.00406e70
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x24], ebx
jae 0x4654bd
lea eax, [ebp - 0x38]
push 1
push 0
push 0x5236e4
push eax
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov esi, ecx
cmp dword [ebp - 0x24], ebx
jb 0x4654f4
mov edx, dword [ebp - 0x38]
push edx
call fcn.004c097a
add esp, 4
xor eax, eax
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x28], 0
mov word [ebp - 0x38], ax
cmp dword [ebp - 8], ebx
jb 0x46548e
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.004c097a
add esp, 4
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c0985
mov esp, ebp
pop ebp
ret
push edi
push 0x52370c
lea esi, [ebp - 0x54]
call fcn.00420fe0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
mov edi, esi
call fcn.00425400
pop edi
cmp eax, 1
jne 0x46557f
call fcn.004099c0
mov eax, esi
call fcn.00421370
cmp dword [ebp - 8], ebx
jb 0x46556a
mov edx, dword [ebp - 0x1c]
push edx
call fcn.004c097a
add esp, 4
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c0985
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x54]
call fcn.00421370
cmp dword [ebp - 8], ebx
jb 0x465598
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004c097a
add esp, 4
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004c0985
mov esp, ebp
pop ebp
ret
Function at 0x4655d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
push 0x38
mov edi, eax
lea eax, [ebp - 0x3c]
push 0
push eax
mov esi, ecx
call fcn.004c5470
mov eax, 8
add esp, 0xc
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x40
mov dword [ebp - 0x34], str.runas
cmp dword [esi + 0x18], eax
jb 0x465613
mov ecx, dword [esi + 4]
mov dword [ebp - 0x30], ecx
jmp 0x465619
add esi, 4
mov dword [ebp - 0x30], esi
cmp dword [edi + 0x18], eax
jb 0x465626
mov edx, dword [edi + 4]
mov dword [ebp - 0x2c], edx
jmp 0x46562c
add edi, 4
mov dword [ebp - 0x2c], edi
lea eax, [ebp - 0x40]
xor esi, esi
push eax
mov dword [ebp - 0x24], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x465647
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
push edx
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x46563f
cmp ebx, esi
je 0x465671
mov ecx, dword [ebp - 4]
mov dword [ebx], ecx
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x465ac0
Capabilities:
Check if file exists
Check os version
Delete registry value
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
mov eax, dword [0x5402b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
mov edi, 1
push ecx
mov ebx, edi
mov word [ebp - 0x20c], ax
call fcn.004c5470
add esp, 0xc
lea edx, [ebp - 0x348]
push edx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x340]
push ecx
push 0x51c620
push str.CLSID30C3B080_30FB_11d0_B724_00AA006C1A01InProcServer32
push SysReAllocStringLen
mov dword [ebp - 0x340], edi
mov dword [ebp - 0x348], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor edx, edx
lea eax, [ebp - 0x20c]
mov word [ebp - 0x224], dx
mov dword [ebp - 0x210], 7
mov dword [ebp - 0x214], 0
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x465b60
sub eax, edx
push esi
sar eax, 1
push eax
lea eax, [ebp - 0x20c]
lea esi, [ebp - 0x228]
call fcn.004017f0
lea eax, [ebp - 0x344]
push eax
mov ecx, esi
push ecx
mov dword [ebp - 0x344], 0x5c
call fcn.0040bd50
cmp eax, 0xffffffff
je 0x465bd5
add eax, edi
cmp eax, 0xffffffff
je 0x465bd5
cmp dword [ebp - 0x210], 8
mov ecx, dword [ebp - 0x224]
jae 0x465bbc
lea ecx, [ebp - 0x224]
lea edx, [ecx + eax*2]
push edx
push 0x523998
call fcn.004c0b2c
add esp, 8
test eax, eax
je 0x465cdc
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004c5470
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x5239b0
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x465cda
push 0x110
lea ecx, [ebp - 0x338]
push 0
push ecx
call fcn.004c5470
add esp, 0xc
lea edx, [ebp - 0x33c]
push edx
mov dword [ebp - 0x33c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x338], 6
jae 0x465cdc
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x465c67
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
sub eax, edx
mov edx, dword [ebp - 0x340]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push edx
push 0x51c620
push str.CLSID30C3B080_30FB_11d0_B724_00AA006C1A01InProcServer32
push SysReAllocStringLen
call esi
push 0xa
push str.Both
mov edi, eax
mov eax, dword [ebp - 0x340]
push eax
push str.ThreadingModel
push str.CLSID30C3B080_30FB_11d0_B724_00AA006C1A01InProcServer32
push SysReAllocStringLen
call esi
push str.Original
push str.CLSID30C3B080_30FB_11d0_B724_00AA006C1A01InProcServer32
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
test edi, edi
je 0x465cdc
xor ebx, ebx
cmp dword [ebp - 0x210], 8
pop esi
jb 0x465cf5
mov ecx, dword [ebp - 0x224]
push ecx
call fcn.004c097a
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.004c0985
mov esp, ebp
pop ebp
ret
Function at 0x465de0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x465e17
mov dword [esi], eax
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x465e13
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
pop ebp
ret
test al, 1
je 0x465df4
mov ecx, dword [ebp + 8]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x465e36
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x465e55
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
pop ebp
ret

Function at 0x465e70
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x5402b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 4
call fcn.00409e20
add esp, 4
lea ecx, [ebp - 0x20]
call fcn.00406f50
mov eax, dword [ebp - 0x1c]
mov ebx, 8
cmp dword [ebp - 8], ebx
jae 0x465ea4
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x465f14
mov ecx, dword [ebp - 0x1c]
cmp dword [ebp - 8], ebx
jae 0x465eba
lea ecx, [ebp - 0x1c]
call fcn.00450b20
test al, al
je 0x465f14
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 8], ebx
jae 0x465ece
lea eax, [ebp - 0x1c]
push 0xa
push 0
push 0
push eax
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov esi, ecx
cmp dword [ebp - 8], ebx
jb 0x465f02
mov edx, dword [ebp - 0x1c]
push edx
call fcn.004c097a
add esp, 4
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c0985
mov esp, ebp
pop ebp
ret
push edi
push 0x51f618
lea esi, [ebp - 0x54]
call fcn.00420fe0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
mov edi, esi
call fcn.00425400
pop edi
cmp eax, 1
jne 0x465f68
call fcn.004099c0
mov eax, esi
call fcn.00421370
cmp dword [ebp - 8], ebx
jb 0x465f53
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004c097a
add esp, 4
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c0985
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x54]
call fcn.00421370
cmp dword [ebp - 8], ebx
jb 0x465f81
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.004c097a
add esp, 4
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004c0985
mov esp, ebp
pop ebp
ret
Function at 0x465ff0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x5402b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov dword [ebp - 0x218], 1
mov word [ebp - 0x20c], ax
call fcn.004c5470
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0xc
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x218]
push ecx
push str.Flags
push str.Control_PanelAccessibilityHighContrast
push SysReAllocStringLen
mov dword [ebp - 0x214], 0x208
call edi
lea eax, [ebp - 0x20c]
lea esi, [ebp - 0x21c]
call fcn.00410420
push eax
mov ecx, 0x523acc
call fcn.0042b110
mov bl, al
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4660a7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test bl, bl
je 0x4660cb
push 6
push 0x523ad4
push 1
push str.Flags
push str.Control_PanelAccessibilityHighContrast
push SysReAllocStringLen
call esi
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x218]
push eax
push str.Use_My_Stylesheet
push str.SoftwareMicrosoftInternet_ExplorerStyles
mov ebx, 4
push SysReAllocStringLen
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x214], ebx
call edi
mov edi, 1
cmp dword [ebp - 0x210], edi
jne 0x466143
mov ecx, dword [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
push ebx
push str.Use_My_Stylesheet
push str.SoftwareMicrosoftInternet_ExplorerStyles
push SysReAllocStringLen
mov dword [ebp - 0x210], 0
call esi
push ebx
lea eax, [ebp - 0x210]
push eax
push ebx
push str.MSCompatibilityMode
push str.SoftwareMicrosoftInternet_ExplorerBrowserEmulation
push SysReAllocStringLen
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x214], ebx
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004c0985
mov esp, ebp
pop ebp
ret
Function at 0x466190
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 4]
push eax
push 0
lea ecx, [ebp - 8]
push ecx
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsConnections
push SysReAllocStringLen
mov dword [ebp - 8], 3
mov dword [ebp - 4], 0
call ebx
test eax, eax
je 0x4661cd
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
push esi
push edx
call fcn.004bffc9
add esp, 4
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
lea ecx, [ebp - 8]
push ecx
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsConnections
push SysReAllocStringLen
call ebx
test eax, eax
jne 0x466225
cmp dword [ebp - 4], 9
jb 0x466225
mov byte [esi + 8], 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
push edx
push esi
push eax
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsConnections
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
neg eax
sbb eax, eax
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x466d40
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x5402b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [edi + 0x18], 8
lea eax, [edi + 4]
mov dword [ebp - 0x28], eax
jb 0x466d5e
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x466d7c
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c0985
mov esp, ebp
pop ebp
ret
push esi
push 1
lea eax, [ebp - 0x24]
push eax
xor eax, eax
mov edx, edi
mov dword [ebp - 0x24], 0x5c
call fcn.0040bc70
mov esi, eax
cmp esi, 0xffffffff
je 0x466e68
xor ecx, ecx
mov dword [ebp - 8], 7
mov dword [ebp - 0xc], 0
mov word [ebp - 0x1c], cx
xor edx, edx
push esi
push edx
push edi
lea eax, [ebp - 0x44]
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], dx
call fcn.004018f0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x20]
call fcn.004018f0
cmp dword [ebp - 0x2c], 8
jb 0x466df3
mov ecx, dword [ebp - 0x40]
push ecx
call fcn.004c097a
add esp, 4
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x466dff
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x466e23
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x466e16
lea eax, [ebp - 0x1c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x466e56
push 1
lea edx, [ebp - 0x24]
push edx
lea eax, [esi + 1]
mov edx, edi
mov dword [ebp - 0x24], 0x5c
call fcn.0040bc70
mov esi, eax
cmp esi, 0xffffffff
jne 0x466db2
mov esi, 8
cmp dword [edi + 0x18], esi
jb 0x466e79
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx]
jmp 0x466e7c
cmp dword [ebp - 8], 8
jb 0x466e68
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004c097a
add esp, 4
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c0985
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x28]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp dword [ebp - 8], esi
jb 0x466e96
mov edx, dword [ebp - 0x1c]
push edx
call fcn.004c097a
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.004c0985
mov esp, ebp
pop ebp
ret
Function at 0x467100
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x5402b0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x29c], ecx
mov edi, 0x51bd00
mov ecx, ebx
lea esi, [ebp - 0x24]
call fcn.0040e390
mov eax, dword [ebp - 0x20]
mov esi, 8
cmp dword [ebp - 0xc], esi
jae 0x46713e
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x294]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x298], eax
cmp eax, 0xffffffff
jne 0x467170
cmp dword [ebp - 0xc], esi
jb 0x4672b1
mov edx, dword [ebp - 0x20]
push edx
jmp 0x4672a9
mov edi, 0x51bcf8
mov ecx, ebx
lea esi, [ebp - 0x2b8]
call fcn.0040e390
lea edi, [ebp - 0x268]
mov ecx, eax
lea esi, [ebp - 0x40]
call fcn.0040e390
mov esi, 8
cmp dword [ebp - 0x2a0], esi
jb 0x4671ae
mov eax, dword [ebp - 0x2b4]
push eax
call fcn.004c097a
add esp, 4
test byte [ebp - 0x294], 0x10
je 0x467240
mov ecx, 0x51bd0c
lea eax, [ebp - 0x268]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4671ec
test dx, dx
je 0x4671e8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4671ec
add eax, 4
add ecx, 4
test dx, dx
jne 0x4671c6
xor eax, eax
jmp 0x4671f1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x467252
mov ecx, 0x51bd10
lea eax, [ebp - 0x268]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x467226
test dx, dx
je 0x467222
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x467226
add eax, 4
add ecx, 4
test dx, dx
jne 0x467200
xor eax, eax
jmp 0x46722b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x467252
lea ecx, [ebp - 0x40]
push ecx
mov ecx, dword [ebp - 0x29c]
call fcn.00467100
jmp 0x467252
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x28], esi
jae 0x46724b
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x28], esi
jb 0x467263
mov edx, dword [ebp - 0x3c]
push edx
call fcn.004c097a
add esp, 4
mov ecx, dword [ebp - 0x298]
lea eax, [ebp - 0x294]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x467170
mov edx, dword [ebp - 0x298]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebx + 0x18], esi
jb 0x467296
mov eax, dword [ebx + 4]
jmp 0x467299
lea eax, [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp dword [ebp - 0xc], esi
jb 0x4672b1
mov eax, dword [ebp - 0x20]
push eax
call fcn.004c097a
add esp, 4
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c0985
mov esp, ebp
pop ebp
ret 4