joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ad05178
Capabilities:
Read file on windows

Disassembly:
xor eax, eax
jmp 0x4ad05217
cmp byte [esi + 1], 0xd
jne 0x4ad051da
jmp 0x4ad0531a
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 1
xor ebx, ebx
push ebx
push ebx
push dword [ebp + 8]
mov edi, 0x4ad29060
mov esi, edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
push dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4ad04873
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
cmp eax, ebx
je 0x4ad04873
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
jle 0x4ad051fa
cmp dword [ebp - 4], 3
jl 0x4ad051e2
mov al, byte [esi]
cmp al, 0xa
je 0x4ad0487a
cmp al, 0xd
je 0x4ad05310
movzx eax, byte [esi]
cmp byte [eax + 0x4ad38740], bl
jne 0x4ad12598
dec dword [ebp - 4]
inc esi
cmp dword [ebp - 4], ebx
jg 0x4ad051ca
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 8]
push edi
push 1
push dword [0x4ad2b9ac]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp byte [esi + 1], 0xa
jne 0x4ad051e2
mov eax, dword [ebp - 0xc]
mov byte [esi + 2], bl
sub esi, edi
inc esi
inc esi
push ebx
push ebx
mov dword [ebp - 8], esi
add esi, eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4ad051fa
cmp dword [ebp - 4], 1
je 0x4ad125a9
sub dword [ebp - 4], 2
inc esi
inc esi
jmp 0x4ad051f5
push ebx
lea eax, [ebp - 4]
push eax
push 1
inc esi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4ad125cc
cmp dword [ebp - 4], ebx
je 0x4ad125cc
inc dword [ebp - 8]
jmp 0x4ad051fa
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
jmp 0x4ad04873
Function at 0x4ad069b2
Capabilities:
Check if file exists
Get common file path
Get file attributes
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x4ad33b38]
push esi
mov esi, dword [ebp + 8]
mov cx, word [esi]
mov dword [ebp - 4], eax
mov ax, word [0x4ad34440]
cmp cx, ax
je 0x4ad10966
cmp cx, 0x2e
je 0x4ad17b83
push edi
lea eax, [ebp - 0x214]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push dword [ebp - 0x214]
mov edi, dword [sym.imp.msvcrt.dll_towupper]
call edi
mov word [ebp - 0xc], 0x3d
mov dword [ebp - 0x62c], eax
xor eax, eax
mov ax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_iswalpha]
test eax, eax
pop ecx
pop ecx
je 0x4ad0b8c1
cmp word [esi + 2], 0x3a
jne 0x4ad0b8c1
xor eax, eax
mov ax, word [esi]
push eax
call edi
pop ecx
add esi, 4
push ebx
xor ebx, ebx
cmp esi, ebx
mov word [ebp - 0xa], ax
mov word [ebp - 8], 0x3a
mov word [ebp - 6], bx
je 0x4ad06a5e
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ebx, eax
mov ax, word [esi]
cmp ax, word [0x4ad34440]
jne 0x4ad0b8db
invalid

Function at 0x4ad07024
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
and dword [esi], 0
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
push 0x4ad07098
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4ad0707a
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push 0x4ad07080
push dword [ebp + 8]
mov dword [ebp - 4], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret 4
Function at 0x4ad0872d
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x4ad33b38]
push esi
lea ecx, [ebp - 0x41c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
xor esi, esi
push eax
mov dword [0x4ad2b9c4], esi
call fcn.4ad087ed
test al, al
je 0x4ad087ce
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x210]
push 0x4ad0300c
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 0x10
push 0x106
lea eax, [ebp - 0x628]
push eax
push esi
lea eax, [ebp - 0x62c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x4ad18aec
lea eax, [ebp - 0x628]
push 0x4ad087e0
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x4ad18ad8
xor al, al
mov ecx, dword [ebp - 4]
pop esi
call fcn.4ad01389
leave
ret 4
cmp dword [ebp - 0x62c], 0xc
jne 0x4ad087ce
mov al, 1
jmp 0x4ad087d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x90
mov dword [0x4ad2b9c4], eax
jne 0x4ad087ce
mov dword [0x4ad2b9c4], esi
jmp 0x4ad087ce
Function at 0x4ad09118
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x46c
mov eax, dword [0x4ad33b38]
push ebx
push esi
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x464], eax
call esi
mov ebx, eax
pop ecx
push dword [ebp - 0x464]
dec ebx
dec ebx
mov dword [edi], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4ad138cc
test al, 0x10
jne 0x4ad138da
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.4ad01389
leave
ret 8
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
jmp 0x4ad13a80
push dword [ebp - 0x464]
call esi
pop ecx
mov ecx, dword [ebp - 0x464]
lea eax, [ecx + eax*2]
cmp word [eax - 2], 0x5c
jne 0x4ad138ff
and word [eax + 2], 0
mov word [eax], 0x2a
jmp 0x4ad1390f
and word [eax + 4], 0
mov word [eax], 0x5c
mov word [eax + 2], 0x2a
lea eax, [ebp - 0x45c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x468], eax
jne 0x4ad13946
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xffffffffffffffff
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, 2
je 0x4ad09167
jmp 0x4ad13a74
mov dword [ebp - 0x460], 1
lea eax, [ebp - 0x430]
push 0x4ad02d34
push eax
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x4ad13a36
lea eax, [ebp - 0x430]
push 0x4ad02d2c
push eax
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x4ad13a36
lea eax, [ebp - 0x430]
push eax
call esi
test eax, eax
pop ecx
je 0x4ad13a36
test byte [ebp - 0x45c], 0x10
jne 0x4ad13a08
push dword [ebp - 0x464]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x20c]
push eax
call esi
and word [ebp + eax*2 - 0x20e], 0
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 0x14
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad09118
test eax, eax
je 0x4ad13a57
mov eax, dword [ebp - 0x46c]
mov ecx, dword [edi]
add eax, ebx
cmp ecx, eax
jle 0x4ad13a34
mov eax, ecx
jmp 0x4ad13a34
mov eax, dword [edi]
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x430]
push eax
call esi
cmp dword [ebp - 0x460], eax
pop ecx
jle 0x4ad13a2a
mov eax, dword [ebp - 0x460]
jmp 0x4ad13a34
lea eax, [ebp - 0x430]
push eax
call esi
pop ecx
mov dword [edi], eax
lea eax, [ebp - 0x45c]
push eax
push dword [ebp - 0x468]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov dword [ebp - 0x460], eax
jne 0x4ad13950
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x468]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x460], 0
jne 0x4ad13a87
cmp esi, 0x12
je 0x4ad09167
push 0
push esi
call fcn.4ad050c9
pop ecx
pop ecx
xor eax, eax
jmp 0x4ad0916a
Function at 0x4ad09434
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
push ebx
push esi
push edi
push 2
pop esi
jne 0x4ad0944a
push 3
pop esi
mov ebx, dword [ebp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
and dword [ebx], 0
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
test eax, eax
je 0x4ad13aaf
xor eax, eax
inc eax
mov dword [ebx], eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4ad13af6
push 0x425a3e80
push 0x23d3
push dword [ebp + 0xc]
call fcn.4ad11c58
sub eax, 0
je 0x4ad13aee
dec eax
dec eax
jne 0x4ad13add
mov eax, dword [ebp + 0x10]
and dword [eax], 0
or esi, 1
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
jmp 0x4ad0946a
xor eax, eax
inc eax
jmp 0x4ad0946c
xor eax, eax
jmp 0x4ad0946c
Function at 0x4ad0ad55
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x66c
mov eax, dword [0x4ad33b38]
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
call fcn.4ad02f54
lea ecx, [ebp - 0x668]
push ecx
lea ecx, [ebp - 0x414]
push ecx
push 0x208
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov esi, eax
test esi, esi
je 0x4ad0adfc
push 4
lea eax, [ebp - 0x414]
push 0x4ad0ae0c
push eax
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
test eax, eax
je 0x4ad17c38
mov eax, dword [ebp - 0x668]
test eax, eax
je 0x4ad17cac
cmp word [eax], 0
je 0x4ad17cac
lea eax, [ebp - 0x66c]
push eax
lea eax, [ebp - 0x664]
push eax
push 0x37
lea eax, [ebp - 0x414]
push eax
call fcn.4ad02774
push dword [ebp - 0x66c]
movzx esi, al
call fcn.4ad03015
test esi, esi
je 0x4ad116b0
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.4ad01389
leave
ret 4
cmp word [ebp - 0x412], 0x5c
je 0x4ad17c8e
cmp word [ebp - 0x412], 0x3a
jne 0x4ad0adfc
cmp word [ebp - 0x410], 0x5c
jne 0x4ad0adfc
cmp word [ebp - 0x40e], si
jne 0x4ad0adfc
jmp 0x4ad17c8e
lea eax, [ebp - 0x40c]
push eax
push edi
mov dword [ebp - 0x668], eax
call dword [sym.imp.msvcrt.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x668], eax
je 0x4ad17c77
cmp eax, edi
jbe 0x4ad17c77
mov si, word [eax]
and word [eax], 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
mov eax, dword [ebp - 0x668]
mov word [eax], si
jmp 0x4ad17c80
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
mov eax, ecx
inc eax
neg eax
sbb eax, eax
and eax, ecx
jmp 0x4ad0adfe
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x4ad0adfc
xor esi, esi
inc esi
jmp 0x4ad0adfc
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov esi, ecx
jmp 0x4ad0adfc
Function at 0x4ad0c561
Capabilities:
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4ad33b38]
and word [ebp - 6], 0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
add eax, 0x40
push esi
mov word [ebp - 0xa], ax
push edi
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xc], 0x3d
mov word [ebp - 8], 0x3a
call fcn.4ad01f78
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ebx, dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edi, eax
test edi, edi
je 0x4ad0d283
push edi
call esi
test al, al
je 0x4ad179ab
push 0
push 0x4ad34460
call fcn.4ad0234c
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.4ad01389
leave
ret 4
mov ax, word [ebp - 0xa]
and word [ebp - 0x20e], 0
mov word [ebp - 0x214], ax
mov ax, word [ebp - 8]
mov word [ebp - 0x212], ax
mov ax, word [0x4ad34440]
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.4ad01682
lea eax, [ebp - 0x214]
push eax
call esi
test eax, eax
je 0x4ad179ba
test edi, edi
je 0x4ad0c5bc
jmp 0x4ad179ce
push 1
call ebx
mov dword [ebp - 0x218], eax
jmp 0x4ad0d283
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.4ad050c9
pop ecx
pop ecx
jmp 0x4ad0d2cf
push dword [ebp - 0x218]
call ebx
jmp 0x4ad0c5bc
Function at 0x4ad0daa4
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 0x1c]
test eax, eax
mov dword [ebp - 4], 0x1a
je 0x4ad16471
push esi
push edi
push eax
call fcn.4ad0db2d
test eax, eax
mov edi, dword [ebp + 0x14]
mov esi, dword [sym.imp.msvcrt.dll__get_osfhandle]
jne 0x4ad16478
mov eax, dword [ebp + 8]
test eax, eax
je 0x4ad0db16
test byte [eax + 0x18], 0x80
jne 0x4ad0db16
push edi
call fcn.4ad01538
test eax, eax
jne 0x4ad0db16
mov eax, dword [0x4ad33afc]
cmp eax, 3
je 0x4ad0db16
cmp dword [ebp + 0x18], 0
je 0x4ad0db16
cmp eax, 2
je 0x4ad0db16
push dword [ebp + 0x18]
push 0
push 0
push edi
call esi
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call fcn.4ad01925
inc dword [0x4ad33b20]
pop edi
pop esi
leave
ret 0x14
mov eax, ecx
jmp 0x4ad0dabf
push edi
call fcn.4ad01538
test eax, eax
jne 0x4ad0dad8
push eax
lea eax, [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 4]
push eax
push edi
call esi
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4ad0dad8

Function at 0x4ad0dec6
Capabilities:
Delete file
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
push edi
push esi
push dword [ebp + 0x10]
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
mov dword [0x4ad33ad8], edi
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x4ad1656a
mov edx, dword [esi]
cmp edx, edi
je 0x4ad1651d
mov ecx, dword [ebp + 0x18]
mov eax, dword [ecx + 0x18]
test ah, 0xc0
jne 0x4ad0df34
cmp edx, 2
jb 0x4ad0df2c
mov edx, dword [ebp + 0xc]
cmp word [edx], 0xfeff
je 0x4ad1653d
or eax, 0x8000
mov dword [ecx + 0x18], eax
mov ecx, dword [ecx + 0x18]
mov eax, 0x8002
xor ebx, ebx
and ecx, eax
inc ebx
cmp ecx, eax
je 0x4ad16547
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0x1c
call ebx
cmp eax, 0x3e3
je 0x4ad1656a
mov edx, dword [esi]
cmp edx, edi
jne 0x4ad0df0e
mov dword [0x4ad2b9c4], edi
xor eax, eax
jmp 0x4ad0df4b
or eax, 0x4000
jmp 0x4ad0df31
mov edi, dword [esi]
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 0xc]
push ebx
call fcn.4ad0edc8
cmp edi, dword [esi]
je 0x4ad0df49
mov dword [0x4ad33ad8], ebx
jmp 0x4ad0df49
call ebx
push dword [ebp + 8]
mov dword [0x4ad2b9c4], eax
call fcn.4ad01925
push dword [ebp + 0x1c]
call fcn.4ad01538
test eax, eax
push dword [ebp + 0x1c]
jne 0x4ad16598
call fcn.4ad01925
push dword [ebp + 0x20]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4ad1659d
call fcn.4ad01925
push 1
push dword [0x4ad2b9c4]
call fcn.4ad1d903
int3
Function at 0x4ad11611
Capabilities:
Check if file exists
Delete directory
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4ad33b38]
and dword [ebp - 0x10], 0
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 4
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp eax, 3
je 0x4ad1802d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push esi
call ebx
test eax, eax
je 0x4ad1804a
mov eax, dword [ebp - 0x10]
pop ebx
mov ecx, dword [ebp - 4]
pop esi
call fcn.4ad01389
leave
ret 4
cmp word [ebp - 0xa], 0x3a
jne 0x4ad11643
cmp word [ebp - 8], 0x5c
jne 0x4ad11643
xor eax, eax
jmp 0x4ad11659
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 5
mov dword [ebp - 0x10], eax
jne 0x4ad1808c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4ad1808c
test al, 1
je 0x4ad1808c
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4ad1808c
push esi
call ebx
test eax, eax
je 0x4ad18087
and dword [ebp - 0x10], 0
jmp 0x4ad1808c
call edi
mov dword [ebp - 0x10], eax
pop edi
jmp 0x4ad11655
Function at 0x4ad1baf9
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x1c
push 0x4ad1bbe0
call fcn.4ad015f8
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], esi
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], esi
mov eax, dword [ebp + 0xc]
cmp eax, esi
je 0x4ad1bb38
cmp word [eax], si
je 0x4ad1bb38
lea edx, [ebp - 0x1c]
push edx
push 1
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x28], eax
cmp eax, esi
jne 0x4ad1bb6b
lea eax, [ebp - 0x24]
push eax
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
push esi
push dword [ebp - 0x1c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call edi
mov dword [ebp - 0x28], eax
cmp eax, 2
jne 0x4ad1bb67
push 0x4ad02b40
call dword [sym.imp.msvcrt.dll__wcsdup]
pop ecx
mov dword [ebp - 0x20], eax
jmp 0x4ad1bbb0
cmp eax, esi
je 0x4ad1bb6e
push eax
jmp 0x4ad1bbaa
push dword [ebp - 0x24]
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov ebx, eax
mov dword [ebp - 0x20], ebx
cmp ebx, esi
je 0x4ad1bba8
lea eax, [ebp - 0x24]
push eax
push ebx
lea eax, [ebp - 0x2c]
push eax
push esi
push esi
push dword [ebp - 0x1c]
call edi
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x4ad1bbb0
push ebx
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov dword [ebp - 0x20], esi
push dword [ebp - 0x28]
jmp 0x4ad1bbaa
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
or dword [ebp - 4], 0xffffffff
call fcn.4ad1bbc9
mov eax, dword [ebp - 0x20]
call fcn.4ad013a2
ret 8
Function at 0x4ad1bbf1
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4ad33b38]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
test eax, eax
push esi
push edi
jne 0x4ad1bcbc
and dword [ebp - 0x210], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov esi, eax
test esi, esi
jne 0x4ad1bc9b
cmp word [ebp - 0x20c], 0x2e
jne 0x4ad1bc82
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.4ad1baf9
mov edi, eax
test edi, edi
je 0x4ad1bca7
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
test eax, eax
pop ecx
je 0x4ad1bc7a
push edi
lea eax, [ebp - 0x20c]
push eax
push str._s_s_r_n
call fcn.4ad04115
add esp, 0xc
mov esi, eax
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
cmp dword [0x4ad2b9a8], 0
jne 0x4ad1bcb7
inc dword [ebp - 0x210]
test esi, esi
jne 0x4ad1bd19
jmp 0x4ad1bc1b
cmp esi, 0x103
jne 0x4ad1bd19
xor esi, esi
jmp 0x4ad1bd19
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.4ad050c9
pop ecx
pop ecx
xor eax, eax
inc eax
jmp 0x4ad1bd1b
push 0
push eax
call fcn.4ad02ce4
mov esi, eax
push 0x20
push esi
call fcn.4ad026cd
test eax, eax
je 0x4ad1bcd6
and word [eax], 0
push esi
push ebx
call fcn.4ad1baf9
mov edi, eax
test edi, edi
je 0x4ad1bcff
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
test eax, eax
pop ecx
je 0x4ad1bcff
push edi
push esi
push str._s_s_r_n
call fcn.4ad04115
mov esi, eax
jmp 0x4ad1bd0e
push esi
xor esi, esi
inc esi
push esi
push 0x23a3
call fcn.4ad050c9
add esp, 0xc
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.4ad01389
leave
ret 8
Function at 0x4ad1bd2f
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push 0x10
push 0x4ad1be48
call fcn.4ad015f8
mov esi, dword [ebp + 0x10]
xor edi, edi
cmp esi, edi
je 0x4ad1bd9f
cmp word [esi], di
je 0x4ad1bd9f
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
push esi
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x4ad1bd7e
push esi
push dword [ebp + 0xc]
push str._s_s_r_n
call fcn.4ad04115
add esp, 0xc
jmp 0x4ad1be00
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.4ad050c9
push dword [ebp + 0xc]
push 1
push 0x235d
call fcn.4ad050c9
add esp, 0x14
jmp 0x4ad1be00
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x4ad1be00
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x4ad1bdd9
cmp eax, 2
je 0x4ad1be00
push edi
push eax
call fcn.4ad050c9
pop ecx
pop ecx
jmp 0x4ad1be00
push 0x4ad02b40
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x4ad1bdf7
push edi
push eax
call fcn.4ad050c9
pop ecx
pop ecx
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x1c], edi
jne 0x4ad1be39
mov dword [ebp - 4], edi
push edi
push edi
push edi
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
jmp 0x4ad1be35
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
call fcn.4ad013a2
ret 0xc
Function at 0x4ad1be59
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4ad33b38]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor esi, esi
cmp edi, esi
mov dword [ebp - 0x214], eax
jne 0x4ad1bf93
mov edi, 0x104
push edi
lea ecx, [ebp - 0x20c]
push ecx
push esi
push eax
mov dword [ebp - 0x218], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, eax
cmp ebx, esi
jne 0x4ad1bf78
mov esi, str.ShellOpenCommand
cmp word [ebp - 0x20c], 0x2e
je 0x4ad1bf45
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
push esi
mov ebx, eax
call dword [sym.imp.msvcrt.dll_wcslen]
lea eax, [eax + ebx + 1]
cmp eax, edi
pop ecx
pop ecx
ja 0x4ad1bf45
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
call fcn.4ad1baf9
and word [ebp + ebx*2 - 0x20c], 0
test eax, eax
mov dword [ebp - 0x210], eax
je 0x4ad1bf38
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
test eax, eax
pop ecx
je 0x4ad1bf38
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
push str._s_s_r_n
call fcn.4ad04115
add esp, 0xc
push dword [ebp - 0x210]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
cmp dword [0x4ad2b9a8], 0
jne 0x4ad1bf8b
inc dword [ebp - 0x218]
push edi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x218]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, eax
test ebx, ebx
je 0x4ad1beaf
cmp ebx, 0x103
jne 0x4ad1c095
xor ebx, ebx
jmp 0x4ad1c095
xor eax, eax
inc eax
jmp 0x4ad1c097
cmp word [edi], 0x2e
jne 0x4ad1bfa1
push 0x7b
pop ebx
jmp 0x4ad1c039
push esi
push edi
call fcn.4ad02ce4
mov edi, eax
push 0x20
push edi
call fcn.4ad026cd
cmp eax, esi
je 0x4ad1bfb9
mov word [eax], si
mov ebx, dword [sym.imp.msvcrt.dll_wcslen]
push edi
call ebx
mov esi, str.ShellOpenCommand
push esi
mov dword [ebp - 0x210], eax
call ebx
pop ecx
pop ecx
mov ecx, dword [ebp - 0x210]
lea eax, [eax + ecx + 1]
cmp eax, 0x104
push edi
jbe 0x4ad1bffb
push 1
push 0x23d9
call fcn.4ad050c9
add esp, 0xc
push 0x7b
pop eax
jmp 0x4ad1c097
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 0x10
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov ebx, eax
test ebx, ebx
je 0x4ad1c04b
push edi
push 1
push 0x23a5
call fcn.4ad050c9
add esp, 0xc
jmp 0x4ad1c095
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
call fcn.4ad1baf9
mov esi, eax
test esi, esi
je 0x4ad1c07d
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
test eax, eax
pop ecx
je 0x4ad1c07d
push esi
push edi
push str._s_s_r_n
call fcn.4ad04115
jmp 0x4ad1c08a
push edi
push 1
push 0x23a5
call fcn.4ad050c9
add esp, 0xc
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.4ad01389
leave
ret 8