joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417c4e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, 0xfa
mov ecx, dword [esp + 0xc]
push edi
cmp ecx, eax
jg 0x417cb8
je 0x417e3c
cmp ecx, 0x6a
jg 0x417c96
je 0x417c87
sub ecx, 0x64
je 0x417e3c
dec ecx
je 0x417e3c
dec ecx
je 0x417e3c
dec ecx
dec ecx
jmp 0x417ca9
cmp dword [0x469c50], 2
jne 0x417e3c
jmp 0x417cd3
sub ecx, 0x6b
je 0x417dcb
dec ecx
je 0x417e3c
sub ecx, 4
je 0x417e3c
dec ecx
je 0x417e3c
jmp 0x417cd3
sub ecx, 0xfb
je 0x417dcb
dec ecx
je 0x417e3c
dec ecx
je 0x417cd3
sub ecx, 0x14
je 0x417cdf
and dword [0x469c50], 0
jmp 0x417e3c
mov dword [0x469c28], 1
mov ecx, dword [esi + 4]
call fcn.0044a1f7
test eax, eax
je 0x417dad
mov ebx, dword [esp + 0x20]
xor edi, edi
mov eax, dword [ebx]
test byte [eax + 0x28], 2
jne 0x417d1f
cmp word [eax + 0x10], 8
jne 0x417d1f
push dword [eax + 0x18]
call dword [sym.imp.MSVCRT.dll_wcslen]
test eax, eax
pop ecx
je 0x417d1f
push 1
pop edi
mov eax, dword [esi + 0x1c]
cmp dword [eax - 8], 0
jne 0x417d34
call fcn.00417777
mov edi, eax
neg edi
sbb edi, edi
inc edi
mov eax, dword [ebx]
test byte [eax + 0x28], 0x20
je 0x417d48
cmp dword [0x48d560], 0
je 0x417d48
push 1
pop edi
cmp dword [0x48d564], 0
je 0x417e3c
test edi, edi
je 0x417e3c
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
shr eax, 0x10
test ax, ax
jne 0x417e3c
mov eax, dword [0x469c50]
cmp eax, 2
je 0x417e3c
cmp eax, 3
je 0x417e3c
push dword [esi + 0x1c]
mov ecx, dword [esi + 4]
call fcn.0044a116
push eax
call fcn.00417764
pop ecx
test eax, eax
pop ecx
je 0x417e3c
mov eax, dword [ebx]
mov eax, dword [eax + 0x38]
jmp 0x417e1a
lea eax, [esi + 0x1c]
lea ecx, [esi + 0x20]
push eax
call fcn.00418e9d
mov eax, dword [esp + 0x20]
inc dword [esi + 0xc]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
or word [eax], 0xffff
jmp 0x417e3c
xor edi, edi
cmp dword [0x469c28], edi
jne 0x417e2a
cmp dword [0x48d564], edi
je 0x417e2a
call fcn.00417777
test eax, eax
jne 0x417e2a
cmp dword [0x469c50], edi
je 0x417dfa
mov ecx, dword [esi + 4]
call fcn.0044a1f7
test eax, eax
jne 0x417e2a
push dword [esi + 0x1c]
mov ecx, dword [esi + 4]
call fcn.0044a116
push eax
call fcn.00417764
pop ecx
test eax, eax
pop ecx
je 0x417e2a
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
mov eax, dword [eax + 8]
or word [eax], 0xffff
mov ecx, esi
call fcn.00417ebb
push 1
pop eax
jmp 0x417e3e
mov ecx, dword [esi + 4]
call fcn.0044a1f7
test eax, eax
je 0x417e3c
mov dword [0x469c50], edi
xor eax, eax
pop edi
pop esi
pop ebx
ret 0x20
Function at 0x41aa89
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c4
mov ax, word [0x469bb8]
push esi
mov edx, ecx
push edi
mov word [ebp - 0x208], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
rep stosd dword es:[edi], eax
mov esi, dword [ebp + 8]
mov ecx, 0xad
stosw word es:[edi], ax
xor eax, eax
lea edi, [ebp - 0x6c4]
push 0x40b868
push eax
push dword [esi + 0x28d0]
rep stosd dword es:[edi], eax
lea ecx, [edx + 0x420]
mov dword [ebp + 8], ecx
call fcn.00458e0a
cmp dword [esi + 0x28b4], 0
jne 0x41ab46
mov ax, word [0x469bb8]
mov ecx, 0x81
mov word [ebp - 0x410], ax
xor eax, eax
lea edi, [ebp - 0x40e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esi + 0x2298]
push eax
lea eax, [esi + 0x2090]
push eax
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x4000
lea eax, [ebp - 0x6c4]
push 0x2b4
push eax
lea eax, [ebp - 0x410]
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
jne 0x41ab78
lea eax, [esi + 0x2298]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x41aba7
push 0x4010
lea ecx, [ebp - 0x6c4]
push 0x2b4
push ecx
push 0x80
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x41aba7
lea eax, [ebp - 0x208]
push 0xa
push eax
push dword [ebp - 0x6c0]
call dword [sym.imp.MSVCRT.dll__itow]
mov ecx, dword [ebp + 8]
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
push 0
push dword [esi + 0x28d0]
call fcn.00458e0a
pop edi
pop esi
leave
ret 4
Function at 0x41dfbb
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push ebx
push esi
push edi
mov ebx, ecx
push dword [ebp + 8]
lea ecx, [ebx + 0x420]
call fcn.00458e72
mov edx, eax
test edx, edx
je 0x41e101
mov ax, word [0x469bb8]
mov esi, 0x81
mov word [ebp - 0x208], ax
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x206]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [edx + 0x2298]
add edx, 0x2090
push eax
lea eax, [ebp - 0x208]
push edx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
xor edi, edi
lea eax, [ebp - 0x208]
push edi
push eax
call fcn.0044dd66
pop ecx
test eax, eax
pop ecx
je 0x41e04d
push 5
push edi
lea eax, [ebp - 0x208]
push edi
push eax
push 0x40bae4
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x41e101
mov dx, word [0x469bb8]
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x40e]
mov word [ebp - 0x410], dx
mov word [ebp - 0x820], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x81e]
mov word [ebp - 0x618], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x616]
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, 0x104
lea eax, [ebp - 0x618]
push edi
push eax
push 0xf
push dword [0x49a554]
call esi
lea eax, [ebp - 0x410]
push edi
push eax
push 0x12c
push dword [0x49a554]
call esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x820]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea eax, [ebp - 0x618]
push 0x40
push eax
lea eax, [ebp - 0x820]
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x421ee0
Capabilities:
Delete file
Set file attributes
Write file on windows

Disassembly:
mov eax, 0x467a8c
call fcn.00466f40
sub esp, 0x238
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
jne 0x421f08
push ebx
call dword [sym.imp.MSVCRT.dll_wcslen]
test eax, eax
pop ecx
je 0x422093
lea ecx, [ebp - 0x3c]
call fcn.0045290d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
mov ecx, dword [eax + 4]
cmp ecx, ebx
jne 0x421f22
mov dword [ebp - 0x10], ebx
jmp 0x421f32
mov eax, dword [eax + 8]
sub eax, ecx
mov ecx, 0x220
cdq
idiv ecx
mov dword [ebp - 0x10], eax
mov ax, word [0x469bb8]
push esi
push edi
mov word [ebp - 0x244], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x242]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp - 0x10]
cmp edi, ebx
jbe 0x422083
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
imul edi, edi, 0x210
add edi, 4
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
pop ecx
cmp esi, ebx
mov dword [ebp - 0x1c], esi
je 0x422083
push 0x40bdcc
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__wfopen]
pop ecx
mov dword [ebp - 0x14], eax
pop ecx
xor eax, eax
mov ecx, edi
mov edi, esi
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
cmp dword [ebp - 0x14], 0
rep stosb byte es:[edi], al
je 0x42207c
mov eax, dword [ebp - 0x10]
lea ebx, [esi + 4]
test eax, eax
mov dword [esi], eax
jbe 0x422053
and dword [ebp - 0x10], 0
mov dword [ebp - 0x18], eax
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x244]
push 0x8001
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x244]
push 0x103
push ecx
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x10]
push dword [ecx + eax + 4]
lea ecx, [ebp - 0x3c]
call fcn.00452d12
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
lea esi, [ebp - 0x244]
shl eax, 1
mov ecx, eax
mov dword [ebx], eax
add ebx, 4
mov edx, ecx
mov edi, ebx
add ebx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0xc]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x10]
add dword [ebp - 0x10], 0x220
mov eax, dword [ecx + eax]
mov dword [ebx], eax
add ebx, 4
dec dword [ebp - 0x18]
jne 0x421fcb
mov esi, dword [ebp - 0x1c]
push dword [ebp - 0x14]
sub ebx, esi
push 1
push ebx
push esi
call dword [sym.imp.MSVCRT.dll_fwrite]
push dword [ebp - 0x14]
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
push 2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 1
pop ebx
push esi
call fcn.00466f25
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.0045294f
pop edi
mov eax, ebx
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x42222b
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x467abc
call fcn.00466f40
sub esp, 0x448
push edi
xor edi, edi
cmp dword [ebp + 8], edi
jne 0x422253
push edi
call dword [sym.imp.MSVCRT.dll_wcslen]
test eax, eax
pop ecx
je 0x4223ef
push 0x40bdd4
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__wfopen]
pop ecx
cmp eax, edi
pop ecx
mov dword [ebp + 8], eax
je 0x4223ef
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push eax
push ecx
mov ecx, esi
call fcn.004229fa
lea ecx, [ebp - 0x454]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], edi
call fcn.004217b9
mov ax, word [0x469bb8]
push dword [ebp + 8]
mov word [ebp - 0x234], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x232]
rep stosd dword es:[edi], eax
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push 1
stosw word es:[edi], ax
lea eax, [ebp - 0x10]
push 4
push eax
call ebx
and dword [ebp - 0x14], 0
add esp, 0x10
cmp dword [ebp - 0x10], 0
jbe 0x4223de
push dword [ebp + 8]
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push 1
push 4
push eax
call ebx
push dword [ebp + 8]
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x234]
push 1
push dword [ebp - 0x18]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x234]
push eax
call ebx
push dword [ebp + 8]
lea eax, [ebp - 0x454]
push 1
push 4
push eax
call ebx
mov edi, dword [ebp + 0x10]
add esp, 0x30
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x422381
push edi
lea ecx, [ebp - 0x2c]
call fcn.0046667f
and dword [ebp - 4], 0
lea eax, [ebp - 0x234]
push eax
push dword [ebp + 0x14]
push edi
call fcn.004220a0
add esp, 0xc
test eax, eax
jne 0x422359
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00466638
jmp 0x4223cf
push eax
lea ecx, [ebp - 0x2c]
call fcn.00466799
mov ecx, dword [eax]
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x450], ecx
mov ecx, dword [ebp - 0x454]
mov dword [eax + 0x14], ecx
lea ecx, [ebp - 0x2c]
call fcn.00466638
jmp 0x4223c1
lea eax, [ebp - 0x234]
push eax
push dword [ebp + 0x14]
push edi
call fcn.004220a0
add esp, 0xc
cmp eax, 0xffffffff
je 0x4223cf
mov edx, dword [ebp + 0x14]
imul eax, eax, 0x220
mov ecx, dword [edx + 4]
lea edi, [ebp - 0x454]
add eax, ecx
mov ecx, 0x88
mov esi, eax
push eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
call fcn.004229a0
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x454]
mov ecx, esi
push eax
call fcn.0042298f
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
jb 0x4222d5
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
push 1
pop eax
pop esi
pop ebx
jmp 0x4223f1
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
leave
ret
Function at 0x4226d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x42280d
cmp dword [ebp + 0x10], edi
je 0x42280d
push ebx
push esi
push dword [ebp + 0xc]
xor esi, esi
call dword [sym.imp.COMCTL32.dll_ImageList_GetImageCount]
test eax, eax
jne 0x422702
or esi, 0xffffffff
lea eax, [ebp - 4]
push 1
push eax
push edi
push edi
push 0x40be90
mov dword [ebp - 4], edi
call fcn.0045eac1
pop ecx
push eax
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
cmp dword [ebp - 4], edi
jne 0x42272c
call fcn.00426b27
mov dword [ebp - 4], eax
push dword [ebp - 4]
push esi
mov esi, dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
push dword [ebp + 0xc]
call esi
push dword [ebp - 4]
mov ebx, dword [sym.imp.USER32.dll_DestroyIcon]
call ebx
mov ax, word [0x469bb8]
mov dword [ebp - 4], edi
mov word [ebp - 0x210], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x210]
push 0xffffffffffffffff
push eax
call fcn.004529f0
mov edi, eax
test edi, edi
je 0x422806
push dword [ebp + 0xc]
mov dword [ebp - 8], 1
call dword [sym.imp.COMCTL32.dll_ImageList_GetImageCount]
cmp eax, 1
jne 0x4227a9
or dword [ebp - 8], 0xffffffff
lea ecx, [ebp - 4]
xor eax, eax
push 1
push ecx
push eax
push eax
push 0x40be74
mov dword [ebp - 4], eax
call fcn.0045eac1
pop ecx
push eax
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
xor eax, eax
cmp dword [ebp - 4], eax
jne 0x4227ed
mov ecx, dword [ebp + 8]
push 1
push eax
push eax
push 1
push edi
call fcn.0045328c
push 0
push eax
push dword [ebp + 0x10]
call dword [sym.imp.COMCTL32.dll_ImageList_GetIcon]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 0xc]
call esi
push dword [ebp - 4]
call ebx
mov ecx, dword [ebp + 8]
push edi
call fcn.00452c09
push 1
pop eax
pop esi
pop ebx
jmp 0x42280f
xor eax, eax
pop edi
leave
ret
Function at 0x422e6a
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x467b06
call fcn.00466f40
sub esp, 0xf4
mov dx, word [0x469bb8]
push ebx
push esi
push edi
mov esi, ecx
push 0xf
pop ecx
xor eax, eax
lea edi, [ebp - 0xfe]
mov word [ebp - 0x100], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0xf
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0xae]
mov dword [ebp - 0xc0], 0x5b
mov byte [ebp - 0xbc], 4
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xb4], ebx
mov word [ebp - 0xb0], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0xf
xor eax, eax
pop ecx
lea edi, [ebp - 0x5e]
mov dword [ebp - 0x70], 0x59
mov byte [ebp - 0x6c], 4
mov dword [ebp - 0x68], 1
mov dword [ebp - 0x64], 0x8c
mov word [ebp - 0x60], dx
push 1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
pop edi
mov ecx, esi
push 5
push ebx
mov dword [ebp - 0x20], 0x5a
mov byte [ebp - 0x1c], 4
mov dword [ebp - 0x18], 0x40
mov dword [ebp - 0x14], edi
call fcn.0046584f
push edi
mov ecx, esi
call fcn.00465be3
push ebx
push ebx
push 2
push edi
push 5
push 3
push edi
push 0x40b1b4
push ebx
push ebx
mov ecx, esi
call fcn.00465777
push 0x20
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, ebx
mov dword [ebp - 4], ebx
je 0x422f5a
mov ecx, eax
call fcn.0045882e
mov dword [ebp - 0x10], eax
jmp 0x422f5d
mov dword [ebp - 0x10], ebx
mov ecx, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
push 0x10
push 0x10
call fcn.00458b50
mov ecx, dword [ebp - 0x10]
push 0x40bed0
call fcn.00458921
push dword [ebp - 0x10]
mov ecx, esi
call fcn.00465d6e
push ebx
push edi
push ebx
push ebx
push 0x3ec
mov ecx, esi
push dword [esi + 8]
push dword [ebp + 8]
push 0x40bec0
call fcn.0046407d
lea eax, [ebp - 0x100]
push 3
push eax
mov ecx, esi
call fcn.00464128
push ebx
push dword [0x49a558]
push 0x3e8
push dword [esi + 8]
push 0x16
push 0x8c
push ebx
push ebx
push 0x54000080
push 0x469bb8
push 0x40beb4
push 0x200
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0xfffffffffffffffc
push eax
mov dword [esi + 0x410], eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
push esi
push 0x40bea0
push dword [esi + 0x410]
mov dword [esi + 0x3fc], eax
call dword [sym.imp.USER32.dll_SetPropW]
push 0x422ddf
push 0xfffffffffffffffc
push dword [esi + 0x410]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push ebx
push ebx
mov ecx, esi
call fcn.0045eb08
push eax
push 0x30
push dword [esi + 0x410]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x422e2c
push esi
push dword [esi + 8]
lea ecx, [esi + 0x400]
call fcn.0044db93
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4252f8
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x82
xor ebp, ebp
lea ebx, [esi + 0x46c]
mov dword [esi + 0x464], eax
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x14]
cmp edi, ebp
je 0x425356
push edi
call dword [sym.imp.MSVCRT.dll_wcslen]
test eax, eax
pop ecx
je 0x425346
push edi
push 0x40b0c0
push 0x103
push ebx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
jmp 0x425356
push 1
push dword [esi + 0x464]
push ebx
push ebp
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp dword [esi + 0x414], ebp
je 0x425396
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push ebp
push ebp
push 0xb
push dword [esi + 0x430]
call edi
lea ecx, [esi + 0x42c]
call fcn.00466899
push ebp
push 1
push 0xb
push dword [esi + 0x430]
call edi
mov ecx, esi
call fcn.00425a83
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x425998
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0xad
xor eax, eax
lea edi, [ebp - 0x2b4]
push eax
rep stosd dword es:[edi], eax
lea edi, [esi + 0x444]
push eax
mov ecx, edi
call fcn.004529f0
mov ebx, eax
test ebx, ebx
je 0x4259f2
push 0x4009
lea eax, [ebp - 0x2b4]
push 0x2b4
push eax
push 0
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push ebx
mov ecx, edi
mov dword [esi + 0x884], eax
call fcn.00452c09
pop edi
pop esi
pop ebx
leave
ret

Function at 0x425a83
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x410], edi
je 0x425b0b
cmp dword [esi + 0x87c], edi
jne 0x425aae
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x87c], eax
cmp dword [esi + 0x880], edi
push ebx
lea ebx, [esi + 0x880]
jne 0x425ac9
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebx], eax
mov eax, dword [esi + 0x87c]
pop ebx
cmp eax, edi
je 0x425b0b
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [esi + 0x87c]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push edi
push esi
push 0x425c34
push edi
push edi
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
cmp eax, edi
je 0x425b0b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
leave
ret
Function at 0x426382
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1090
call fcn.00466f70
mov eax, dword [0x40bc80]
push esi
mov dword [ebp - 0x24], eax
mov eax, dword [0x40bc84]
push edi
mov dword [ebp - 0x20], eax
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 1
stosw word es:[edi], ax
pop esi
lea eax, [ebp - 4]
push eax
push 0x40bf5c
push SysReAllocString
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4264a4
lea eax, [ebp - 0x1e]
push 0xa
push eax
xor edi, edi
push esi
mov esi, dword [sym.imp.MSVCRT.dll__itow]
mov word [ebp - 0x4a], di
mov dword [ebp - 0xc], 0x1046
call esi
add esp, 0xc
lea eax, [ebp - 0xc]
mov dword [ebp - 8], edi
mov dword [ebp - 0x48], 7
push eax
lea eax, [ebp - 0x1090]
push eax
push edi
lea eax, [ebp - 0x24]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
push dword [ebp - 4]
call edi
test eax, eax
jne 0x42649b
lea eax, [ebp - 0x1090]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
test eax, eax
pop ecx
jbe 0x426468
mov eax, dword [ebp - 8]
push dword [ebp + 0xc]
inc dword [ebp - 8]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x1090]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x1090]
push eax
call fcn.0042634c
pop ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], eax
pop ecx
lea eax, [ebp - 0x48]
push eax
push 0xffffffffffffffff
push 0x40b
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
inc dword [ebp - 0x10]
lea eax, [ebp - 0x1e]
push 0xa
push eax
push dword [ebp - 0x10]
call esi
add esp, 0xc
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x1046
push eax
lea eax, [ebp - 0x1090]
push eax
push 0
lea eax, [ebp - 0x24]
push 0
push eax
push dword [ebp - 4]
jmp 0x42640f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
leave
ret
Function at 0x4265e3
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x127c
call fcn.00466f70
mov eax, dword [0x40bc80]
push ebx
mov dword [ebp - 0x234], eax
mov eax, dword [0x40bc84]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x230], eax
mov ecx, 0x80
xor eax, eax
lea edi, [ebp - 0x22c]
push esi
rep stosd dword es:[edi], eax
call dword [sym.imp.MSVCRT.dll_wcslen]
test eax, eax
pop ecx
je 0x426759
push esi
push dword [ebp + 8]
call fcn.00426545
pop ecx
cmp eax, 0xffffffff
pop ecx
jne 0x426759
push dword [ebp + 0x10]
and dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x24], esi
push esi
call fcn.0042634c
pop ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
pop ecx
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x40b
push dword [ebp + 8]
call esi
mov ebx, 0x40bf5c
mov edi, SysReAllocString
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 8]
push eax
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x426759
xor ebx, ebx
push ebx
push ebx
push 0x146
push dword [ebp + 8]
call esi
push 0x18
mov dword [ebp + 0xc], eax
pop eax
cmp dword [ebp + 0xc], eax
jle 0x4266b6
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 4], eax
jle 0x426750
mov dword [ebp + 0x10], 1
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x127c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
push ebx
push 0x40d
mov dword [ebp - 0x20], 0x824
push dword [ebp + 8]
mov word [ebp - 0x127c], bx
call esi
lea eax, [ebp - 0x22e]
push 0xa
push eax
push dword [ebp + 0x10]
call dword [sym.imp.MSVCRT.dll__itow]
add esp, 0xc
cmp dword [ebp - 0x24], ebx
je 0x426740
push dword [ebp - 0x24]
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
call edi
test eax, eax
pop ecx
jbe 0x426740
push dword [ebp - 0x24]
call edi
pop ecx
shl eax, 1
push eax
lea eax, [ebp - 0x234]
push dword [ebp - 0x24]
push 1
push ebx
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
inc dword [ebp + 0x10]
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
jl 0x4266cb
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret