joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42dc60
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push ebx
mov dword [esp + 0x10], 0
call dword [sym.imp.MSVCRT.dll_wcslen]
lea esi, [eax + 1]
lea edi, [esi + esi]
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, eax
add esp, 8
test edx, edx
je 0x42dd16
mov ecx, edi
push ebp
mov ebp, ecx
xor eax, eax
mov edi, edx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebp
and ecx, 3
test esi, esi
rep stosb byte es:[edi], al
je 0x42dce5
cmp esi, 0x7fffffff
ja 0x42dce5
mov ebp, SysReAllocString
mov edi, ebx
sub ebp, esi
mov eax, edx
sub edi, edx
lea ecx, [esi + ebp]
test ecx, ecx
je 0x42dcd9
mov cx, word [edi + eax]
test cx, cx
je 0x42dcd9
mov word [eax], cx
add eax, 2
dec esi
jne 0x42dcbe
jmp 0x42dcdd
test esi, esi
jne 0x42dce0
sub eax, 2
mov word [eax], 0
lea eax, [esp + 0x10]
push eax
push 0
push edx
push 0x42dd20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
pop ebp
test esi, esi
je 0x42dd16
push 0x3e8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x42fe30
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x820
push ebx
push esi
push edi
mov esi, dword [esp + 0x830]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x216]
mov word [esp + 0x214], 0
rep stosd dword es:[edi], eax
mov ebx, dword [sym.imp.MSVCRT.dll__snwprintf]
push esi
stosw word es:[edi], ax
push 0x53d4a4
lea eax, [esp + 0x21c]
push 0x103
push eax
call ebx
lea ecx, [esp + 0x224]
push 0x5c
push ecx
call dword [sym.imp.MSVCRT.dll_wcsrchr]
add esp, 0x18
test eax, eax
je 0x42fea3
add eax, 2
lea edx, [esp + 0x214]
push eax
push edx
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x626]
mov word [esp + 0x624], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x624]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [esp + 0x214]
lea edx, [esp + 0x624]
push ecx
push edx
push 0x53dc6c
lea eax, [esp + 0x18]
push 0x103
push eax
call ebx
mov cx, word [0x5711d0]
xor eax, eax
mov word [esp + 0x430], cx
mov ecx, 0x81
lea edi, [esp + 0x432]
push str.Skin
rep stosd dword es:[edi], eax
push 0x57147c
push str._s_s_
lea edx, [esp + 0x43c]
push 0x103
push edx
stosw word es:[edi], ax
call ebx
lea eax, [esp + 0x444]
push eax
call fcn.0043fb20
lea ecx, [esp + 0x448]
push 1
lea edx, [esp + 0x3c]
push ecx
push edx
call fcn.00440380
add esp, 0x38
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0xc]
push ecx
call edi
push 0
push esi
call fcn.00440200
add esp, 8
push esi
call edi
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x820
ret 4
Function at 0x4396c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push esi
mov esi, 1
call fcn.00438e90
test eax, eax
je 0x439743
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
lea edx, [esp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push ecx
push edx
push str.DownProgID
push str.Software360360se3
push SysReAllocStringLen
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [esp + 0x10], 0
pop edi
je 0x439739
lea eax, [esp + 0xc]
push 0x55114c
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x439743
xor eax, eax
pop esi
add esp, 0x210
ret
mov eax, esi
pop esi
add esp, 0x210
ret
Function at 0x43f1d0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
xor ebp, ebp
push esi
cmp eax, ebp
push edi
mov esi, ecx
mov dword [esp + 0x10], ebp
je 0x43f2d8
lea edi, [esi + 0x22c]
push 0x103
push eax
push edi
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0xc
push ebp
push 0x80
push 4
push ebp
push 1
push SysReAllocStringLen
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x43f2d8
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x6400000
mov dword [esi + 0x220], eax
mov dword [esi + 0x224], eax
mov dword [esp + 0x18], ebp
jbe 0x43f24a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4
inc eax
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
add esp, 4
cmp edi, ebp
mov dword [esi + 0x21c], edi
jne 0x43f26a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4
mov ecx, dword [esi + 0x220]
xor eax, eax
inc ecx
push ebp
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esi + 0x220]
mov edx, dword [esi + 0x21c]
lea eax, [esp + 0x1c]
push eax
push ecx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43f2b8
mov eax, dword [esi + 0x220]
mov ecx, dword [esp + 0x18]
cmp eax, ecx
jne 0x43f2b8
mov dword [esp + 0x10], 1
jmp 0x43f2d1
mov eax, dword [esi + 0x21c]
cmp eax, ebp
je 0x43f2d1
push eax
call fcn.0051e1fa
add esp, 4
mov dword [esi + 0x21c], ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
mov dword [esi + 0x228], ebp
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x43f500
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
test ebx, ebx
je 0x43f566
mov esi, dword [esp + 0x18]
test esi, esi
je 0x43f566
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push 0x80000080
push 2
push 0
push 3
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x43f566
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x10]
push 0
push eax
push edi
push ebx
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push esi
jne 0x43f56e
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
ret 0xc
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, edi
pop edi
pop esi
pop ebx
sete al
ret 0xc
Function at 0x43f630
Capabilities:
Read file via mapping

Disassembly:
mov eax, dword [esp + 4]
push ebx
test eax, eax
push edi
je 0x43f67e
mov edi, dword [esp + 0x10]
test edi, edi
je 0x43f67e
mov ebx, dword [esp + 0x14]
test ebx, ebx
jbe 0x43f67e
push esi
xor esi, esi
push esi
push esi
push esi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x43f678
mov ecx, ebx
mov esi, eax
mov edx, ecx
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
ret
pop edi
xor eax, eax
pop ebx
ret

Function at 0x43f690
Capabilities:
Read file via mapping

Disassembly:
mov eax, dword [esp + 4]
push ebp
test eax, eax
push edi
je 0x43f6e5
mov edi, dword [esp + 0x10]
test edi, edi
je 0x43f6e5
mov ebp, dword [esp + 0x14]
test ebp, ebp
jbe 0x43f6e5
push ebx
xor ebx, ebx
push esi
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [esp + 0x24]
lea esi, [eax + ecx]
test esi, esi
je 0x43f6de
mov ecx, ebp
push eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ebx, eax
mov eax, ebx
pop esi
pop ebx
pop edi
pop ebp
ret
pop edi
xor eax, eax
pop ebp
ret

Function at 0x43faf0
Capabilities:
Create directory

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
test esi, esi
jne 0x43fb16
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov eax, 1
je 0x43fb18
mov eax, esi
pop esi
ret
Function at 0x443e70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x51f916
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004ff840
xor edi, edi
lea ecx, [esi + 0xef0]
mov dword [esp + 0x18], edi
call fcn.00445d60
push edi
lea ecx, [esi + 0x2480]
mov byte [esp + 0x1c], 1
call fcn.004e8370
mov al, byte [esp + 0xb]
mov ecx, dword [esp + 0x10]
mov byte [esi + 0x24cc], al
mov dword [esi + 0x24d0], edi
mov dword [esi + 0x24d4], edi
mov dword [esi + 0x24d8], edi
mov dword [esi + 0x247c], edi
mov dword [esi + 0x24c0], edi
mov dword [esi + 0x24bc], edi
mov dword [esi + 0x24c8], edi
mov dword [esi], 0x52773c
mov dword [esi + 4], 0x527728
mov dword [esi + 0x28], 0x527724
mov dword [esi + 0x30], 0x527714
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x443e88
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x51f916
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004ff840
xor edi, edi
lea ecx, [esi + 0xef0]
mov dword [esp + 0x18], edi
call fcn.00445d60
push edi
lea ecx, [esi + 0x2480]
mov byte [esp + 0x1c], 1
call fcn.004e8370
mov al, byte [esp + 0xb]
mov ecx, dword [esp + 0x10]
mov byte [esi + 0x24cc], al
mov dword [esi + 0x24d0], edi
mov dword [esi + 0x24d4], edi
mov dword [esi + 0x24d8], edi
mov dword [esi + 0x247c], edi
mov dword [esi + 0x24c0], edi
mov dword [esi + 0x24bc], edi
mov dword [esi + 0x24c8], edi
mov dword [esi], 0x52773c
mov dword [esi + 4], 0x527728
mov dword [esi + 0x28], 0x527724
mov dword [esi + 0x30], 0x527714
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x443f40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x51f936
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi], 0x52773c
mov dword [edi + 4], 0x527728
mov dword [edi + 0x28], 0x527724
mov dword [edi + 0x30], 0x527714
mov ebx, dword [edi + 0x24d4]
mov esi, dword [edi + 0x24d0]
cmp esi, ebx
mov dword [esp + 0x18], 1
je 0x443fc8
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov eax, dword [esi]
mov edx, dword [0x53c120]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x443fc0
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x443fc0
mov eax, dword [esi]
sub eax, 0xc
push eax
call fcn.0051e1fa
add esp, 4
add esi, 4
cmp esi, ebx
jne 0x443f99
pop ebp
mov eax, dword [edi + 0x24d0]
push eax
call fcn.0051e1fa
xor ebx, ebx
add esp, 4
lea ecx, [edi + 0x2480]
mov dword [edi + 0x24d0], ebx
mov dword [edi + 0x24d4], ebx
mov dword [edi + 0x24d8], ebx
call fcn.004e83c0
lea ecx, [edi + 0xef0]
mov byte [esp + 0x18], bl
call fcn.00445eb0
mov ecx, edi
mov dword [esp + 0x18], 0xffffffff
call fcn.004ffb70
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x445d60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x51f9e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0050bd10
lea edi, [esi + 0x24]
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x18], ebx
call fcn.004f9290
push ebx
push ebx
push ebx
lea eax, [esi + 0x30]
push ebx
push eax
mov dword [esi], 0x5277c8
mov dword [edi], 0x5277c4
call dword [sym.imp.USER32.dll_SetRect]
push 0xffffff
mov dword [esi + 0x44], 0xffffff
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esi + 0x40], eax
mov ecx, 0x82
xor eax, eax
lea edi, [esi + 0x48]
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esi + 0x250]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.MSVCRT.dll_wcscpy]
lea ecx, [esi + 0x14ac]
push 0x55b280
push ecx
mov dword [esi + 0x458], 0x717171
mov dword [esi + 0x2c], ebx
call edi
lea edx, [esi + 0x14ec]
push 0x55b270
push edx
call edi
lea eax, [esi + 0x152c]
push 0x55b25c
push eax
call edi
add esp, 0x18
mov ecx, 0x412
xor eax, eax
lea edi, [esi + 0x45c]
mov dword [esi + 0x1578], ebx
mov dword [esi + 0x156c], ebx
mov dword [esi + 0x1570], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x1584], ebx
mov dword [esi + 0x157c], 8
mov dword [esi + 0x1580], 5
mov dword [esi + 0x14a8], ebx
mov dword [esi + 0x1588], 0x12
mov dword [esi + 0x1574], ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x447dc0
Capabilities:
Move file

Disassembly:
sub esp, 0x208
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
push 0
push str.user.dat
mov ecx, 0x571210
stosw word es:[edi], ax
call fcn.0040c2e0
mov esi, eax
push str.user.dat
lea eax, [esp + 0xc]
push 0x103
push eax
call fcn.0043f800
push 0
push esi
call fcn.0043f710
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileW]
add esp, 0x14
test eax, eax
jne 0x447e22
lea ecx, [esp + 8]
push esi
push ecx
call edi
push str.history.dat
lea edx, [esp + 0xc]
push 0x103
push edx
call fcn.0043f800
add esp, 0xc
mov ecx, 0x571210
push 0
push str.history.dat
call fcn.0040c2e0
mov esi, eax
push 0
push esi
call fcn.0043f710
add esp, 8
test eax, eax
jne 0x447e63
lea eax, [esp + 8]
push esi
push eax
call edi
pop edi
pop esi
add esp, 0x208
ret

Function at 0x44e270
Capabilities:
Set file attributes

Disassembly:
push esi
push edi
mov edi, ecx
push 0
push str.secache.ini
mov ecx, 0x571210
lea esi, [edi + 0x2c]
call fcn.0040c2e0
push eax
push 0x53d4a4
push 0x103
push esi
call dword [sym.imp.MSVCRT.dll__snwprintf]
push 1
add edi, 0x28
push esi
push edi
call fcn.00496700
add esp, 0x1c
push 2
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop edi
pop esi
ret
Function at 0x44ea40
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x2c]
push edi
call ebx
lea eax, [esi + 0x28]
push 0
push eax
call fcn.00496950
add esp, 8
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
call ebx
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebx
test eax, eax
je 0x44ea8c
push 1
push 0x55b524
push str.Main
call fcn.0040e9d0
add esp, 0xc
ret

Function at 0x450560
Capabilities:
Parse url

Disassembly:
mov eax, 0x1494
call fcn.0051e250
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14a4]
test esi, esi
push edi
je 0x4506c9
cmp word [esi], 0
je 0x4506c9
mov eax, dword [esp + 0x14ac]
test eax, eax
je 0x4506c9
mov dx, word [0x5711d0]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x256]
mov word [esp + 0x254], dx
mov word [esp + 0x4c], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x4e]
mov ebx, dword [sym.imp.MSVCRT.dll_wcslen]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x254]
push edx
mov dword [esp + 0x18], eax
mov eax, 0x104
lea ecx, [esp + 0x50]
push 0
push esi
mov dword [esp + 0x1c], 0x3c
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], eax
call ebx
mov ebp, dword [sym.imp.WININET.dll_InternetCrackUrlW]
add esp, 4
push eax
push esi
call ebp
test eax, eax
jne 0x450678
mov ecx, 0x411
lea edi, [esp + 0x45e]
mov word [esp + 0x45c], ax
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x55b670
lea eax, [esp + 0x464]
push 0x823
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea ecx, [esp + 0x10]
lea edx, [esp + 0x45c]
push ecx
push 0
push edx
call ebx
add esp, 4
push eax
lea eax, [esp + 0x468]
push eax
call ebp
test eax, eax
je 0x4506c9
mov edx, dword [esp + 0x14b0]
mov esi, dword [esp + 0x14ac]
xor eax, eax
mov edi, esi
lea ecx, [edx + edx]
mov ebx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
dec edx
rep stosb byte es:[edi], al
lea ecx, [esp + 0x4c]
lea eax, [esp + 0x254]
push ecx
push eax
push 0x55b648
push edx
push esi
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1494
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1494
ret
Function at 0x450db0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0xc
mov eax, 4
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
push esi
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0xc]
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
push ebx
push esi
push SysReAllocStringLen
mov dword [esp + 0x30], 0
call edi
mov ebp, eax
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x450e2c
lea eax, [esp + 0x10]
lea ecx, [esp + 0x24]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
push 0x55b6c0
push esi
push SysReAllocStringLen
mov dword [esp + 0x3c], 0
call edi
test eax, eax
jne 0x450e2c
mov eax, dword [esp + 0x24]
mov dword [esp + 0x28], eax
test ebp, ebp
jne 0x450e3c
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
cmp eax, ecx
je 0x450e5a
lea edx, [esp + 0x28]
push 4
push edx
push 4
push ebx
push esi
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x450ee0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x40
lea eax, [esp + 0xc]
push esi
lea ecx, [esp + 0x14]
push eax
xor esi, esi
push ecx
push 1
lea edx, [esp + 0x30]
push esi
push edx
mov dword [esp + 0x24], esi
mov dword [esp + 0x38], 0xbcde0395
mov word [esp + 0x3c], 0xe52f
mov word [esp + 0x3e], 0x467c
mov byte [esp + 0x40], 0x8e
mov byte [esp + 0x41], 0x3d
mov byte [esp + 0x42], 0xc4
mov byte [esp + 0x43], 0x57
mov byte [esp + 0x44], 0x92
mov byte [esp + 0x45], 0x91
mov byte [esp + 0x46], 0x69
mov byte [esp + 0x47], 0x2e
mov dword [esp + 0x28], 0xa95664d2
mov word [esp + 0x2c], 0x9614
mov word [esp + 0x2e], 0x4f35
mov byte [esp + 0x30], 0xa7
mov byte [esp + 0x31], 0x46
mov byte [esp + 0x32], 0xde
mov byte [esp + 0x33], 0x8d
mov byte [esp + 0x34], 0xb6
mov byte [esp + 0x35], 0x36
mov byte [esp + 0x36], 0x17
mov byte [esp + 0x37], 0xe6
mov dword [esp + 0x48], 0xbfa971f1
mov word [esp + 0x4c], 0x4d5e
mov word [esp + 0x4e], 0x40bb
mov byte [esp + 0x50], 0x93
mov byte [esp + 0x51], 0x5e
mov byte [esp + 0x52], 0x96
mov byte [esp + 0x53], 0x70
mov byte [esp + 0x54], 0x39
mov byte [esp + 0x55], 0xbf
mov byte [esp + 0x56], 0xbe
mov byte [esp + 0x57], 0xe4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x45106d
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x45106d
lea edx, [esp + 0xc]
mov dword [esp + 0xc], esi
mov ecx, dword [eax]
push edx
push 1
push esi
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x451063
mov eax, dword [esp + 0xc]
cmp eax, esi
je 0x451063
lea edx, [esp + 8]
mov dword [esp + 8], esi
mov ecx, dword [eax]
push edx
push esi
lea edx, [esp + 0x3c]
push 1
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x451059
mov eax, dword [esp + 8]
cmp eax, esi
je 0x451059
lea edx, [esp + 4]
mov dword [esp + 4], esi
mov ecx, dword [eax]
push edx
push esi
push 0x57e8a0
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x45104f
mov eax, dword [esp + 4]
cmp eax, esi
je 0x45104f
mov edx, dword [esp + 0x48]
mov ecx, dword [eax]
push esi
push edx
push eax
call dword [ecx + 0x14]
mov esi, eax
mov eax, dword [esp + 4]
neg esi
mov ecx, dword [eax]
push eax
sbb esi, esi
inc esi
call dword [ecx + 8]
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, esi
pop esi
add esp, 0x40
ret
Function at 0x451080
Capabilities:
Create process on windows
Get common file path
Get program files directory
Initialize iwebbrowser2
Query or enumerate registry value

Disassembly:
sub esp, 0x440
push ebx
push esi
mov esi, dword [esp + 0x44c]
xor ebx, ebx
cmp esi, ebx
je 0x451252
cmp word [esi], bx
je 0x451252
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x3e]
mov word [esp + 0x3c], bx
mov word [esp + 0x244], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x246]
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x248]
push 0x26
push eax
push ebx
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], 0x208
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [esp + 0x244]
lea edx, [esp + 0x3c]
push ecx
push 0x55b774
push 0x103
push edx
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea eax, [esp + 0x4c]
push ebx
push eax
call fcn.0043f710
add esp, 0x18
test eax, eax
pop edi
jne 0x45121e
lea ecx, [esp + 0x14]
lea edx, [esp + 0x38]
push ecx
lea eax, [esp + 0x14]
push edx
push eax
push 0x5711d0
push 0x55b6f0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [esp + 0x38]
push ebx
push ecx
call fcn.0043f710
add esp, 8
test eax, eax
jne 0x45121e
mov word [esp + 0x38], bx
lea eax, [esp + 8]
mov dword [esp + 8], ebx
push eax
push 0x52e100
push 0x15
push ebx
push 0x52e0d0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x451252
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x451210
lea edx, [esp + 0xc]
mov dword [esp + 0xc], ebx
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x94]
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x4511c0
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [esp + 0xc]
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea edx, [esp + 0x18]
mov esi, eax
push edx
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x1c]
mov word [esp + 0x1c], bx
push edx
lea edx, [esp + 0x20]
push edx
lea edx, [esp + 0x24]
push edx
lea edx, [esp + 0x38]
mov word [esp + 0x38], 8
mov dword [esp + 0x40], esi
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xd0]
mov eax, dword [esp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
pop esi
mov eax, 1
pop ebx
add esp, 0x440
ret
cmp word [esp + 0x38], bx
je 0x451166
push 0xa
push ebx
lea edx, [esp + 0x40]
push esi
push edx
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
mov eax, 1
pop ebx
add esp, 0x440
ret
pop esi
xor eax, eax
pop ebx
add esp, 0x440
ret