joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b647c
Capabilities:
Check if file exists
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
mov eax, dword [0x5da2b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x61c]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, 0x208
push esi
push 0
push eax
mov dword [ebp - 0x620], ebx
call fcn.004bf1c0
push esi
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.004bf1c0
lea eax, [ebp - 0x61c]
push ebx
push eax
call fcn.004d2a59
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.004d2a59
lea eax, [ebp - 0x61c]
push eax
call fcn.004c8113
lea eax, [ebp - 0x414]
push eax
call fcn.004c8113
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.004d518c
add esp, 0x38
test eax, eax
je 0x4b65d0
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b65d0
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor esi, esi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004bf1c0
add esp, 0xc
lea eax, [ebp - 0x20c]
test esi, esi
jne 0x4b6559
push edi
push 0x58a178
push eax
call fcn.004b7428
add esp, 0xc
jmp 0x4b6569
push esi
push edi
push str._s.bak_d
push eax
call fcn.004b7428
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b6587
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.004c7eb9
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push edi
push dword [ebp - 0x620]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 5
test eax, eax
lea eax, [ebp - 0x20c]
push 0
push eax
jne 0x4b65ce
call ebx
cmp esi, 0xa
jge 0x4b65d0
inc esi
jmp 0x4b6528
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00437c42
mov esp, ebp
pop ebp
ret
Function at 0x4b675d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 4]
push edi
push eax
xor edi, edi
mov ebx, 0xf013f
push ebx
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push reloc.WS2_32.dll_closesocket
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], edi
call esi
test eax, eax
jne 0x4b6835
lea eax, [ebp - 8]
push eax
push ebx
push edi
push str.SoftWare
push dword [ebp - 4]
call esi
test eax, eax
je 0x4b67b6
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4b6835
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0xc]
push edi
push eax
push edi
push ebx
push edi
push edi
push edi
push dword [ebp + 8]
push dword [ebp - 8]
call esi
test eax, eax
je 0x4b67da
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4b682b
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push ebx
push edi
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x4b67f8
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4b6826
push dword [ebp + 0x18]
call fcn.004d2a7b
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0x18]
push 1
push edi
push dword [ebp + 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0xc]
call esi
push dword [ebp - 8]
call esi
push dword [ebp - 4]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b683c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
lea eax, [ebp - 0xc]
xor edi, edi
push eax
mov ebx, 0xf013f
mov dword [ebp - 0xc], edi
push ebx
push edi
push str.SoftWare
push reloc.WS2_32.dll_accept
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b68f9
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 8]
push edi
push eax
push edi
push ebx
push edi
push edi
push edi
push dword [ebp + 8]
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x4b689a
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4b68f8
push edi
lea eax, [ebp - 4]
push eax
push edi
push ebx
push edi
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp - 8]
call esi
test eax, eax
je 0x4b68c0
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
jmp 0x4b68f6
push dword [ebp + 0x14]
call fcn.004d2a7b
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0x14]
push 1
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 8]
call esi
push dword [ebp - 0xc]
call esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b7492
Capabilities:
Check if file exists
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.00437c60
mov eax, dword [0x5da2b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x3e8
lea eax, [ebp - 0xc10]
push esi
xor edi, edi
push edi
push eax
call fcn.004bf1c0
push esi
lea eax, [ebp - 0xffc]
push edi
push eax
call fcn.004bf1c0
lea eax, [ebp + 0xc]
push eax
push edi
push dword [ebp + 8]
lea eax, [ebp - 0xc10]
push 0x1f3
push 0x1f4
push eax
call fcn.004b790a
xor eax, eax
mov word [ebp - 0x82a], ax
lea eax, [ebp - 0xc10]
push eax
lea eax, [ebp - 0xffc]
push str._zip__s_n
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
add esp, 0x3c
mov word [ebp - 0xc16], ax
lea eax, [ebp - 0xffc]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov esi, 0x208
lea eax, [ebp - 0x61c]
push esi
push edi
push eax
call fcn.004bf1c0
push str.C:log_
mov ebx, 0x104
lea eax, [ebp - 0x61c]
push ebx
push eax
call fcn.004d5481
push 0x571890
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push str._s_s.log
push eax
call fcn.004b3414
push esi
lea eax, [ebp - 0x824]
push edi
push eax
call fcn.004bf1c0
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.004bf1c0
add esp, 0x40
lea eax, [ebp - 0x20c]
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.004bf40d
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x414]
push eax
call esi
test eax, eax
je 0x4b76b3
lea eax, [ebp - 0x20c]
push eax
call fcn.004d2a7b
lea ecx, [ebp - 0x20a]
lea eax, [ecx + eax*2]
push eax
lea eax, [ebp - 0x824]
push ebx
push eax
call fcn.004d5481
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push str._s_s.txt
push eax
call fcn.004b3414
add esp, 0x20
lea eax, [ebp - 0x414]
push eax
call esi
xor ebx, ebx
inc ebx
test eax, eax
lea eax, [ebp - 0x414]
push 0x58a458
push eax
cmovne edi, ebx
call fcn.004c6bf9
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4b76b3
test edi, edi
jne 0x4b7659
push esi
push 2
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x1004], 0xfeff
push ebx
push eax
call fcn.004c7912
add esp, 0x10
lea eax, [ebp - 0xc10]
push eax
call fcn.004d2a7b
push esi
add eax, eax
push eax
lea eax, [ebp - 0xc10]
push ebx
push eax
call fcn.004c7912
push esi
push 2
lea eax, [ebp - 0x1000]
mov dword [ebp - 0x1000], 0xd
push ebx
push eax
call fcn.004c7912
push esi
push 2
lea eax, [ebp - 0x1000]
mov dword [ebp - 0x1000], 0xa
push ebx
push eax
call fcn.004c7912
push esi
call fcn.004c69a1
add esp, 0x38
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00437c42
mov esp, ebp
pop ebp
ret
Function at 0x4b76c4
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2038
call fcn.00437c60
mov eax, dword [0x5da2b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x208
lea eax, [ebp - 0x61c]
push edi
xor esi, esi
push esi
push eax
call fcn.004bf1c0
push str.C:log_
mov ebx, 0x104
lea eax, [ebp - 0x61c]
push ebx
push eax
call fcn.004d5481
push 0x800
lea eax, [ebp - 0x1028]
push esi
push eax
call fcn.004bf1c0
push 0x571890
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push str._s_s.log
push eax
call fcn.004b3414
push edi
lea eax, [ebp - 0x824]
push esi
push eax
call fcn.004bf1c0
add esp, 0x40
lea eax, [ebp - 0x20c]
push edi
push esi
push eax
call fcn.004bf1c0
add esp, 0xc
lea eax, [ebp - 0x20c]
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.004bf40d
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x414]
push eax
call edi
test eax, eax
je 0x4b78f9
lea eax, [ebp - 0x20c]
push eax
call fcn.004d2a7b
lea ecx, [ebp - 0x20a]
lea eax, [ecx + eax*2]
push eax
lea eax, [ebp - 0x824]
push ebx
push eax
call fcn.004d5481
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push str._s_s.txt
push eax
call fcn.004b3414
lea eax, [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x1028]
push 0x3ff
push 0x400
push eax
call fcn.004b790a
push esi
call fcn.004cf739
mov dword [ebp - 0x2038], eax
lea eax, [ebp - 0x2038]
push eax
mov dword [ebp - 0x2034], edx
call fcn.004d65c4
add esp, 0x40
lea ecx, [ebp - 0x1028]
push ecx
push dword [eax]
mov ecx, dword [eax + 0x10]
push dword [eax + 4]
inc ecx
push dword [eax + 8]
push dword [eax + 0xc]
mov eax, dword [eax + 0x14]
push ecx
add eax, 0x76c
push eax
lea eax, [ebp - 0x2028]
push str.__d__d__d__d__d__d_:_s
push eax
call fcn.004b7474
xor eax, eax
add esp, 0x24
mov word [ebp - 0x82a], ax
lea eax, [ebp - 0x414]
push eax
call edi
xor ebx, ebx
inc ebx
test eax, eax
lea eax, [ebp - 0x414]
push 0x58a458
push eax
cmovne esi, ebx
call fcn.004c6bf9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4b78f9
test esi, esi
jne 0x4b789f
push edi
push 2
lea eax, [ebp - 0x2030]
mov dword [ebp - 0x2030], 0xfeff
push ebx
push eax
call fcn.004c7912
add esp, 0x10
lea eax, [ebp - 0x2028]
push eax
call fcn.004d2a7b
push edi
add eax, eax
push eax
lea eax, [ebp - 0x2028]
push ebx
push eax
call fcn.004c7912
push edi
push 2
lea eax, [ebp - 0x202c]
mov dword [ebp - 0x202c], 0xd
push ebx
push eax
call fcn.004c7912
push edi
push 2
lea eax, [ebp - 0x202c]
mov dword [ebp - 0x202c], 0xa
push ebx
push eax
call fcn.004c7912
push edi
call fcn.004c69a1
add esp, 0x38
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00437c42
mov esp, ebp
pop ebp
ret
Function at 0x4b9fe6
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x56ee8a
call fcn.004e715b
xor esi, esi
mov dword [ebp - 0x18], 0x104
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.004440c4
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
call fcn.004440f8
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x4ba026
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4ba086
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4ba061
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4ba086
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x10]
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x3c]
call fcn.004440d7
call fcn.004e7124
ret 0xc
Function at 0x4ba40a
Capabilities:
Get common file path

Disassembly:
push 0x240
mov eax, 0x56fa24
call fcn.004e718f
mov ebx, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
xor esi, esi
mov dword [ebp - 0x24c], edi
push esi
push eax
call fcn.004bf1c0
add esp, 0xc
lea eax, [ebp - 0x218]
push esi
push 0x19
push eax
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call esi
test eax, eax
je 0x4ba501
and dword [ebp - 0x220], 0
xor eax, eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
je 0x4ba486
lea eax, [ebp - 0x218]
push eax
call fcn.004d2a7b
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00419cc0
and dword [ebp - 4], 0
push 0x57190c
call fcn.004d2a7b
pop ecx
push eax
push 0x57190c
lea ecx, [ebp - 0x230]
call fcn.0041e910
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push edi
cmovae eax, dword [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.004ba0cc
mov edi, eax
lea ecx, [ebp - 0x230]
push 0
push 1
test edi, edi
je 0x4ba4f2
call fcn.00430390
mov eax, edi
jmp 0x4ba5b3
or dword [ebp - 4], 0xffffffff
call fcn.00430390
mov edi, dword [ebp - 0x24c]
push 0
push 0x10
lea eax, [ebp - 0x218]
push eax
push 0
call esi
test eax, eax
je 0x4ba5b1
and dword [ebp - 0x238], 0
xor eax, eax
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], ax
cmp word [ebp - 0x218], ax
je 0x4ba548
lea eax, [ebp - 0x218]
push eax
call fcn.004d2a7b
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.00419cc0
mov esi, 0x57190c
mov dword [ebp - 4], 1
push esi
call fcn.004d2a7b
pop ecx
push eax
push esi
lea ecx, [ebp - 0x248]
call fcn.0041e910
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
push edi
cmovae eax, dword [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.004ba0cc
push 0
lea ecx, [ebp - 0x248]
mov esi, eax
push 1
call fcn.00430390
test esi, esi
je 0x4ba5b1
mov eax, esi
jmp 0x4ba5b3
xor eax, eax
call fcn.004e7139
ret 4
Function at 0x4ba5bb
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x5da2b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x428], eax
xor edi, edi
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], edi
push eax
push 9
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push reloc.WS2_32.dll_accept
mov esi, edi
mov dword [ebp - 0x41c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4ba60e
xor eax, eax
jmp 0x4ba70d
push ebx
push 0x208
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.004bf1c0
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ebx, edi
push 0x104
push eax
push edi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4ba6fa
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4ba6e0
push 0x208
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x420], 0x104
push eax
call fcn.004bf1c0
add esp, 0xc
xor eax, eax
inc eax
mov dword [ebp - 0x424], eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x424]
push eax
push 0
push str.DisplayName
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4ba6d8
push dword [ebp - 0x428]
lea eax, [ebp - 0x414]
push eax
call fcn.004bf4ae
pop ecx
pop ecx
test eax, eax
push 1
pop eax
cmovne esi, eax
push dword [ebp - 0x41c]
call edi
push 0x104
lea eax, [ebp - 0x20c]
inc ebx
push eax
push ebx
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x4ba64a
push dword [ebp - 0x418]
call edi
mov eax, esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00437c42
mov esp, ebp
pop ebp
ret 4
Function at 0x4bb051
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x5da2b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x428], eax
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x418], ebx
push ebx
push eax
mov esi, ebx
mov dword [ebp - 0x41c], ebx
call fcn.004bf1c0
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
push 0x109
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4bb19c
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ebx
jmp 0x4bb176
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4bb168
push 0x208
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x420], 0x104
push eax
call fcn.004bf1c0
add esp, 0xc
xor eax, eax
inc eax
mov dword [ebp - 0x424], eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x424]
push eax
push 0
push str.DisplayName
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4bb160
push dword [ebp - 0x428]
lea eax, [ebp - 0x414]
push eax
call fcn.004bf4ae
pop ecx
pop ecx
test eax, eax
push 1
pop eax
cmovne esi, eax
push dword [ebp - 0x41c]
call edi
push 0x104
lea eax, [ebp - 0x20c]
inc ebx
push eax
push ebx
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x4bb0d2
push dword [ebp - 0x418]
call edi
test esi, esi
jne 0x4bb291
xor ebx, ebx
lea eax, [ebp - 0x418]
push eax
push 9
push ebx
push 0x58a320
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4bb291
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
jmp 0x4bb275
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4bb267
push 0x208
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x424], 0x104
push eax
call fcn.004bf1c0
add esp, 0xc
xor eax, eax
inc eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x420]
push eax
push 0
push str.DisplayName
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4bb25f
push dword [ebp - 0x428]
lea eax, [ebp - 0x414]
push eax
call fcn.004bf4ae
pop ecx
pop ecx
test eax, eax
push 1
pop eax
cmovne esi, eax
push dword [ebp - 0x41c]
call edi
push 0x104
lea eax, [ebp - 0x20c]
inc ebx
push eax
push ebx
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x4bb1d1
push dword [ebp - 0x418]
call edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00437c42
mov esp, ebp
pop ebp
ret 4
Function at 0x4bb3e7
Capabilities:
Check if file exists
Get common file path
Get startup folder

Disassembly:
push 0x83c
mov eax, 0x56fb45
call fcn.004e718f
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
xor ebx, ebx
push ebx
push eax
call fcn.004bf1c0
add esp, 0xc
lea eax, [ebp - 0x218]
push ebx
push 0x1a
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov dword [ebp - 0x834], 7
mov dword [ebp - 0x838], ebx
mov word [ebp - 0x848], ax
cmp word [ebp - 0x218], ax
je 0x4bb452
lea eax, [ebp - 0x218]
push eax
call fcn.004d2a7b
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x848]
call fcn.00419cc0
mov dword [ebp - 4], ebx
mov ebx, str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar_
push ebx
call fcn.004d2a7b
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x848]
call fcn.0041e910
xor ebx, ebx
cmp word [esi], bx
jne 0x4bb48c
mov eax, ebx
jmp 0x4bb493
push esi
call fcn.004d2a7b
pop ecx
push eax
push esi
lea ecx, [ebp - 0x848]
call fcn.0041e910
mov esi, str..lnk
push esi
call fcn.004d2a7b
pop ecx
push eax
push esi
lea ecx, [ebp - 0x848]
call fcn.0041e910
cmp dword [ebp - 0x834], 8
lea eax, [ebp - 0x848]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x848]
push eax
call esi
test eax, eax
je 0x4bb5a1
push 0x208
lea eax, [ebp - 0x830]
push ebx
push eax
call fcn.004bf1c0
push 0x208
lea eax, [ebp - 0x628]
push ebx
push eax
call fcn.004bf1c0
cmp dword [ebp - 0x834], 8
lea eax, [ebp - 0x848]
cmovae eax, dword [ebp - 0x848]
push eax
lea eax, [ebp - 0x830]
push eax
call fcn.004d2a59
add esp, 0x20
lea eax, [ebp - 0x628]
mov ecx, edi
push eax
lea eax, [ebp - 0x830]
push eax
call fcn.004b9ecc
push 0x208
lea eax, [ebp - 0x420]
push ebx
push eax
call fcn.004bf1c0
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea eax, [ebp - 0x420]
push eax
call fcn.004d2a7b
pop ecx
test eax, eax
jne 0x4bb58f
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.004d2a59
pop ecx
pop ecx
lea eax, [ebp - 0x420]
push eax
call esi
test eax, eax
je 0x4bb5a1
xor esi, esi
inc esi
jmp 0x4bb5a3
mov esi, ebx
push ebx
push 1
lea ecx, [ebp - 0x848]
call fcn.00430390
mov eax, esi
call fcn.004e7139
ret 4
Function at 0x4bb5bb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5da2b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x5e9b98]
test al, al
jne 0x4bb654
push ebx
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004bf1c0
add esp, 0xc
lea eax, [ebp - 0x20c]
xor ebx, ebx
inc ebx
push ebx
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4bb64b
lea eax, [ebp - 0x20c]
push eax
call fcn.004c8113
lea eax, [ebp - 0x20c]
mov dword [esp], str.config_systemprofile
push eax
call fcn.004bf4ae
pop ecx
pop ecx
test eax, eax
jne 0x4bb643
lea eax, [ebp - 0x20c]
push str.cocuments_and_settingslocalService
push eax
call fcn.004bf4ae
pop ecx
pop ecx
test eax, eax
je 0x4bb64b
mov byte [0x5e9b98], bl
jmp 0x4bb651
mov bl, byte [0x5e9b98]
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00437c42
mov esp, ebp
pop ebp
ret
Function at 0x4bc173
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5da2b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
push edi
push 0x208
xor esi, esi
mov edi, ecx
push esi
push eax
call fcn.004bf1c0
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push 0x17
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4bc1de
lea eax, [ebp - 0x20c]
push 0x57190c
push eax
call fcn.004d2a28
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.004bb662
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00437c42
mov esp, ebp
pop ebp
ret 4