joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b2f0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x443593
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x453140]
xor eax, esp
mov dword [esp + 0x274], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x453140]
xor eax, esp
push eax
lea eax, [esp + 0x28c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x29c]
mov dword [esp + 0x18], eax
xor ebx, ebx
push 0x250
lea ecx, [esp + 0x3c]
push ebx
push ecx
mov dword [esp + 0x2a0], ebx
call fcn.00431940
mov eax, dword [esp + 0x2b4]
mov ebp, 8
add esp, 0xc
cmp dword [esp + 0x2bc], ebp
jae 0x40b36e
lea eax, [esp + 0x2a8]
lea edx, [esp + 0x38]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
je 0x40b498
mov edi, dword [esp + 0x2a0]
mov edi, edi
test byte [esp + 0x38], 0x10
je 0x40b479
lea eax, [esp + 0x64]
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], bx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40b3b3
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x24]
call fcn.00401cc0
mov esi, dword [esp + 0x30]
cmp esi, 1
mov byte [esp + 0x294], 1
mov edx, esi
jb 0x40b3e9
mov edx, 1
cmp dword [esp + 0x34], ebp
mov ecx, dword [esp + 0x20]
jae 0x40b3f7
lea ecx, [esp + 0x20]
cmp edx, ebx
mov eax, 0x448428
jbe 0x40b41c
mov bp, word [ecx]
cmp bp, word [eax]
jne 0x40b4d9
add ecx, 2
add eax, 2
sub edx, 1
jne 0x40b400
mov ebp, 8
cmp esi, 1
jb 0x40b42d
xor eax, eax
cmp esi, 1
setne al
cmp eax, ebx
je 0x40b45f
push 2
push 0x448420
push esi
push ebx
lea ecx, [esp + 0x2c]
call fcn.004031b0
test eax, eax
je 0x40b45f
cmp dword [esp + 0x34], ebp
mov eax, dword [esp + 0x20]
jae 0x40b451
lea eax, [esp + 0x20]
mov edx, dword [esp + 0x18]
push eax
push ebx
push edi
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esp + 0x34], ebp
mov byte [esp + 0x294], bl
jb 0x40b479
mov eax, dword [esp + 0x20]
push eax
call fcn.004317a4
add esp, 4
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x38]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40b390
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x2bc], ebp
jb 0x40b4b1
mov edx, dword [esp + 0x2a8]
push edx
call fcn.004317a4
add esp, 4
mov ecx, dword [esp + 0x28c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x274]
xor ecx, esp
call fcn.004320c7
add esp, 0x284
ret
mov cx, bp
cmp cx, word [eax]
sbb eax, eax
and eax, 0xfffffffe
add eax, 1
cmp eax, ebx
je 0x40b417
mov ebp, 8
jmp 0x40b429
Function at 0x40c100
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x4436bb
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x453140]
xor eax, esp
mov dword [esp + 0x244], eax
push ebx
push esi
push edi
mov eax, dword [0x453140]
xor eax, esp
push eax
lea eax, [esp + 0x258]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x268]
mov edi, ecx
push edi
push 0x40c010
push ebx
call dword [sym.imp.USER32.dll_EnumChildWindows]
xor esi, esi
push 0x206
lea eax, [esp + 0x52]
push esi
push eax
mov word [esp + 0x58], si
call fcn.00431940
add esp, 0xc
push 0x104
lea ecx, [esp + 0x50]
push ecx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [esp + 0x4c]
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], esi
mov word [esp + 0x34], si
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x40c193
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x50]
push edx
lea ecx, [esp + 0x38]
call fcn.00401cc0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0xffffffffffffffff
push esi
lea eax, [esp + 0x54]
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], esi
push eax
mov dword [esp + 0x288], esi
mov word [ecx + 4], si
call fcn.00401bd0
lea ecx, [esp + 0x30]
push ecx
lea ecx, [edi + 0x74]
call fcn.004308a0
mov esi, 8
cmp dword [eax + 0x18], esi
jb 0x40c1f8
mov eax, dword [eax + 4]
jmp 0x40c1fb
add eax, 4
push eax
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextW]
cmp dword [esp + 0x2c], esi
jb 0x40c216
mov edx, dword [esp + 0x18]
push edx
call fcn.004317a4
add esp, 4
cmp dword [esp + 0x48], esi
jb 0x40c229
mov eax, dword [esp + 0x34]
push eax
call fcn.004317a4
add esp, 4
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.004320c7
add esp, 0x254
ret 4

Function at 0x40e1e0
Capabilities:
Enumerate gui resources

Disassembly:
push esi
mov esi, dword [esp + 8]
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
mov dword [ecx], ecx
mov ecx, dword [esi + 4]
mov dword [ecx + 4], ecx
cmp eax, dword [esi + 4]
mov dword [esi + 8], 0
je 0x40e213
push edi
nop
mov edi, dword [eax]
push eax
call fcn.004317a4
add esp, 4
cmp edi, dword [esi + 4]
mov eax, edi
jne 0x40e200
pop edi
push esi
push 0x40e1a0
call dword [sym.imp.USER32.dll_EnumWindows]
mov al, 1
pop esi
ret
Function at 0x4132d0
Capabilities:
Hide graphical window

Disassembly:
cmp byte [esp + 4], 0
push ebx
push ebp
push esi
push edi
mov esi, ecx
je 0x413351
mov eax, dword [esi + 0xc8]
push 4
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x44]
mov edi, dword [ecx]
lea ebx, [esi + 0x40]
cmp ebx, ebx
mov ebp, dword [ebx + 4]
je 0x413300
call fcn.00431cf0
cmp edi, ebp
je 0x41332b
cmp edi, dword [ebx + 4]
jne 0x41330e
call fcn.00431cf0
mov edx, dword [edi + 8]
mov eax, dword [edx + 4]
push 4
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp edi, dword [ebx + 4]
jne 0x413327
call fcn.00431cf0
mov edi, dword [edi]
jmp 0x4132f4
push 1
mov ecx, esi
call fcn.00410970
push 1
push 0
mov ecx, esi
call fcn.0040f660
push 1
push 0
mov ecx, esi
call fcn.0040f660
pop edi
pop esi
pop ebp
pop ebx
ret 4
cmp byte [esi + 0x181], 0
jne 0x41334a
mov ecx, dword [esi + 0xc8]
push 4
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov edx, dword [esi + 0xc8]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edx
call ebx
mov eax, dword [esi + 0xcc]
push 0
push eax
call ebx
mov ecx, dword [esi + 0x44]
lea edi, [esi + 0x40]
mov esi, dword [ecx]
lea ecx, [ecx]
cmp edi, edi
mov ebp, dword [edi + 4]
je 0x41339c
call fcn.00431cf0
cmp esi, ebp
je 0x41334a
cmp esi, dword [edi + 4]
jne 0x4133aa
call fcn.00431cf0
mov edx, dword [esi + 8]
mov eax, dword [edx + 4]
push 0
push eax
call ebx
cmp esi, dword [edi + 4]
jne 0x4133bf
call fcn.00431cf0
mov esi, dword [esi]
jmp 0x413390
Function at 0x41e130
Capabilities:
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x444b04
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x453140]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov eax, dword [esi + 0xc8]
push 1
push eax
mov dword [esp + 0x2c], 0xc
call dword [sym.imp.USER32.dll_UnregisterHotKey]
mov ecx, dword [esi + 0xc4]
xor ebp, ebp
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x20]
cmp eax, ebp
je 0x41e192
push eax
call dword [sym.imp.SHELL32.dll_SHChangeNotifyDeregister]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push ebp
mov ebx, 7
mov dword [ecx + 0x18], ebx
mov dword [ecx + 0x14], ebp
push 0x447624
mov word [ecx + 4], bp
call fcn.00401cc0
mov ecx, esi
call fcn.00407f40
mov ecx, esi
call fcn.004040b0
mov edx, dword [esi + 0xc8]
mov edi, dword [sym.imp.USER32.dll_DestroyWindow]
push edx
call edi
mov eax, dword [esi + 0xcc]
push eax
call edi
mov ecx, dword [esi + 0x10]
mov edi, dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
push ecx
call edi
mov edx, dword [esi + 0xc]
push edx
call edi
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebp
push ebp
push ebp
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
mov edi, 8
cmp dword [esi + 0x2fc], edi
jb 0x41e221
mov eax, dword [esi + 0x2e8]
push eax
call fcn.004317a4
add esp, 4
mov dword [esi + 0x2fc], ebx
mov dword [esi + 0x2f8], ebp
lea ecx, [esi + 0x1f0]
mov word [esi + 0x2e8], bp
mov byte [esp + 0x24], 0xa
call fcn.00405830
cmp dword [esi + 0x1ac], edi
jb 0x41e25b
mov eax, dword [esi + 0x198]
push eax
call fcn.004317a4
add esp, 4
mov dword [esi + 0x1ac], ebx
mov dword [esi + 0x1a8], ebp
lea ecx, [esi + 0x12c]
mov word [esi + 0x198], bp
mov byte [esp + 0x24], 8
call fcn.0041ff50
cmp dword [esi + 0x128], edi
jb 0x41e295
mov eax, dword [esi + 0x114]
push eax
call fcn.004317a4
add esp, 4
mov dword [esi + 0x128], ebx
mov dword [esi + 0x124], ebp
lea edi, [esi + 0x100]
mov word [esi + 0x114], bp
mov eax, dword [edi + 4]
cmp eax, ebp
je 0x41e2d1
mov edx, dword [esp + 0x18]
mov ecx, dword [edi + 8]
push edx
push edi
push ecx
push eax
call fcn.00407cb0
mov eax, dword [edi + 4]
push eax
call fcn.004317a4
add esp, 0x14
mov dword [edi + 4], ebp
mov dword [edi + 8], ebp
mov dword [edi + 0xc], ebp
cmp dword [esi + 0xfc], 8
jb 0x41e2f2
mov eax, dword [esi + 0xe8]
push eax
call fcn.004317a4
add esp, 4
mov dword [esi + 0xfc], ebx
mov dword [esi + 0xf8], ebp
lea ecx, [esi + 0xc0]
mov word [esi + 0xe8], bp
mov byte [esp + 0x24], 4
call fcn.0042ffc0
lea ecx, [esi + 0x74]
mov byte [esp + 0x24], 3
call fcn.0041e0a0
lea ecx, [esi + 0x40]
call fcn.00403e30
lea ecx, [esi + 0x34]
call fcn.00403e30
lea edi, [esi + 0x28]
mov ecx, edi
call fcn.0040d9e0
mov eax, dword [edi + 4]
push eax
call fcn.004317a4
add esp, 4
mov ecx, esi
mov dword [edi + 4], ebp
mov dword [esp + 0x24], 0xffffffff
call fcn.0042fe40
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x427110
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x449bb4
push eax
call fcn.0043382d
push 8
mov esi, eax
call fcn.004324d8
push esi
push 1
mov edi, eax
push 2
push edi
call fcn.0043374c
push esi
push 1
lea ecx, [edi + 2]
push 2
push ecx
call fcn.0043374c
push esi
push 1
lea ebx, [edi + 4]
push 2
push ebx
call fcn.0043374c
movzx edx, word [ebx]
shl edx, 4
add edx, 6
push edx
push edi
call fcn.00433295
mov edi, eax
movzx eax, word [edi + 4]
add esp, 0x44
push esi
push 1
shl eax, 4
push eax
lea ecx, [edi + 8]
push ecx
call fcn.0043374c
push esi
call fcn.00432b2e
push edi
call fcn.00427080
push edi
mov esi, eax
call fcn.004323fb
add esp, 0x1c
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x427560
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x427579
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret

Function at 0x427770
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x445841
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x453140]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov esi, dword [esp + 0x30]
mov ecx, esi
mov dword [esp + 0x28], ebx
call fcn.004205c0
mov ebp, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
push ebp
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x427811
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebx
je 0x427811
mov ecx, dword [esp + 0x34]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
lea edx, [esp + 0x1c]
push edi
push edx
call fcn.00427680
add esp, 0xc
push eax
mov ecx, esi
mov dword [esp + 0x2c], 1
call fcn.00420e00
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call fcn.0041ff50
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x42b1f0
Capabilities:
Set registry value

Disassembly:
push ecx
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0x10]
push ebx
push edi
xor edi, edi
mov ebx, 8
cmp dword [esp + 0x2c], ebx
mov dword [esp + 8], edi
jae 0x42b210
lea eax, [esp + 0x18]
lea edx, [esp + 8]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x42b261
cmp dword [esp + 0x64], ebx
mov ecx, dword [esp + 0x50]
jae 0x42b22f
lea ecx, [esp + 0x50]
cmp dword [esp + 0x48], ebx
mov eax, dword [esp + 0x34]
jae 0x42b23d
lea eax, [esp + 0x34]
mov edx, dword [esp + 0x60]
lea edx, [edx + edx + 2]
push edx
push ecx
push 1
push edi
push eax
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x2c], ebx
jb 0x42b274
mov edx, dword [esp + 0x18]
push edx
call fcn.004317a4
add esp, 4
cmp dword [esp + 0x48], ebx
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
mov word [esp + 0x18], di
jb 0x42b298
mov eax, dword [esp + 0x34]
push eax
call fcn.004317a4
add esp, 4
cmp dword [esp + 0x64], ebx
mov dword [esp + 0x44], edi
mov word [esp + 0x34], di
pop edi
mov dword [esp + 0x44], 7
pop ebx
jb 0x42b2be
mov ecx, dword [esp + 0x48]
push ecx
call fcn.004317a4
add esp, 4
mov al, 1
pop ecx
ret
Function at 0x42bb60
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x445f18
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x453140]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x453140]
xor eax, esp
push eax
lea eax, [esp + 0x228]
mov dword fs:[0], eax
mov esi, dword [esp + 0x238]
mov eax, dword [esp + 0x23c]
xor edi, edi
mov dword [esp + 0x14], edi
mov ecx, dword [esp + 0x244]
mov ebp, 8
cmp dword [esp + 0x258], ebp
mov dword [esp + 0x230], 2
mov dword [esp + 0x18], 0x208
jae 0x42bbde
lea ecx, [esp + 0x244]
lea edx, [esp + 0x14]
push edx
push 0x20019
push edi
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42bd09
cmp dword [esp + 0x274], ebp
mov eax, dword [esp + 0x260]
jae 0x42bc10
lea eax, [esp + 0x260]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
push edi
push edi
push eax
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x42bcc9
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x280]
mov ebx, 7
push ecx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], edi
mov ecx, esi
mov word [esi + 4], di
call fcn.00401bd0
cmp dword [esp + 0x258], ebp
jb 0x42bc6a
mov edx, dword [esp + 0x244]
push edx
call fcn.004317a4
add esp, 4
cmp dword [esp + 0x274], ebp
mov word [esp + 0x244], di
mov dword [esp + 0x254], edi
mov dword [esp + 0x258], ebx
jb 0x42bc99
mov eax, dword [esp + 0x260]
push eax
call fcn.004317a4
add esp, 4
cmp dword [esp + 0x290], ebp
mov dword [esp + 0x274], ebx
mov dword [esp + 0x270], edi
mov word [esp + 0x260], di
jb 0x42bda1
mov ecx, dword [esp + 0x27c]
push ecx
jmp 0x42bd99
cmp dword [esp + 0x18], edi
jbe 0x42bd09
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.00401da0
cmp dword [esp + 0x258], ebp
jb 0x42bcff
mov edx, dword [esp + 0x244]
push edx
call fcn.004317a4
add esp, 4
mov ebx, 7
jmp 0x42bc6a
push 0xffffffffffffffff
push edi
lea edx, [esp + 0x280]
mov ebx, 7
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], edi
push edx
mov ecx, esi
mov word [esi + 4], di
call fcn.00401bd0
cmp dword [esp + 0x258], ebp
jb 0x42bd43
mov eax, dword [esp + 0x244]
push eax
call fcn.004317a4
add esp, 4
cmp dword [esp + 0x274], ebp
mov word [esp + 0x244], di
mov dword [esp + 0x254], edi
mov dword [esp + 0x258], ebx
jb 0x42bd72
mov ecx, dword [esp + 0x260]
push ecx
call fcn.004317a4
add esp, 4
cmp dword [esp + 0x290], ebp
mov word [esp + 0x260], di
mov dword [esp + 0x270], edi
mov dword [esp + 0x274], ebx
jb 0x42bda1
mov edx, dword [esp + 0x27c]
push edx
call fcn.004317a4
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x228]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.004320c7
add esp, 0x220
ret
Function at 0x42d160
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x4461d3
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x453140]
xor eax, esp
mov dword [esp + 0x7c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x453140]
xor eax, esp
push eax
lea eax, [esp + 0x94]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0x21], bl
mov dword [esp + 0x9c], ebx
mov dword [esp + 0x14], ebx
je 0x42d2ba
mov eax, 7
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], bx
mov dword [esp + 0x50], eax
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], bx
mov dword [esp + 0x6c], eax
mov dword [esp + 0x68], ebx
mov word [esp + 0x58], bx
mov dword [esp + 0x8c], eax
mov dword [esp + 0x88], ebx
mov word [esp + 0x78], bx
mov al, byte [esi + 0x20]
push 0xffffffffffffffff
push ebx
lea ecx, [esi + 0x24]
push ecx
lea ecx, [esp + 0x80]
mov byte [esp + 0xa8], 1
mov byte [esp + 0x7d], al
call fcn.00401bd0
mov edx, dword [esi]
push 0xffffffffffffffff
push ebx
lea eax, [esi + 4]
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x7c], 1
mov dword [esp + 0x24], edx
call fcn.00401bd0
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0xac]
push ecx
lea ecx, [esp + 0x44]
call fcn.00401bd0
mov edi, dword [esi + 0x44]
mov eax, dword [edi + 4]
add esi, 0x40
lea edx, [esp + 0x18]
push edx
push eax
push edi
mov ecx, esi
call fcn.0042c4d0
push 1
mov ecx, esi
mov ebp, eax
call fcn.0042ba60
mov dword [edi + 4], ebp
mov ecx, dword [ebp + 4]
mov dword [ecx], ebp
lea ecx, [esp + 0x18]
call fcn.0042b2d0
mov edi, 8
cmp dword [esp + 0xbc], edi
jb 0x42d291
mov eax, dword [esp + 0xa8]
push eax
call fcn.004317a4
add esp, 4
xor al, al
mov ecx, dword [esp + 0x94]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x7c]
xor ecx, esp
call fcn.004320c7
add esp, 0x8c
ret 0x1c
cmp dword [esi + 0x38], ebx
mov edi, 8
jbe 0x42d323
cmp dword [esi + 0x3c], edi
jb 0x42d2ce
mov eax, dword [esi + 0x28]
jmp 0x42d2d1
lea eax, [esi + 0x28]
cmp dword [esp + 0xbc], edi
mov ecx, dword [esp + 0xa8]
jae 0x42d2e8
lea ecx, [esp + 0xa8]
cmp dword [esi + 0x1c], edi
jb 0x42d2f2
mov esi, dword [esi + 8]
jmp 0x42d2f4
add esi, edi
push eax
push ebx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
test eax, eax
setne bl
cmp dword [esp + 0xbc], edi
jb 0x42d31c
mov edx, dword [esp + 0xa8]
push edx
call fcn.004317a4
add esp, 4
mov al, bl
jmp 0x42d293
cmp dword [esi + 0x1c], edi
jb 0x42d32d
mov eax, dword [esi + 8]
jmp 0x42d330
lea eax, [esi + 8]
mov edx, dword [esi]
lea ecx, [esp + 0x14]
push ecx
push 2
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42d278
cmp dword [esp + 0xbc], edi
mov eax, dword [esp + 0xa8]
jae 0x42d361
lea eax, [esp + 0xa8]
push eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0xbc], edi
jb 0x42d391
mov edx, dword [esp + 0xa8]
push edx
call fcn.004317a4
add esp, 4
mov al, 1
jmp 0x42d293
Function at 0x42e8e0
Capabilities:
Get common file path

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 8
lea eax, [esp + 4]
push eax
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x42e920
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 4]
push ebx
push edx
push eax
call fcn.0042e790
mov ecx, dword [esp + 0x10]
add esp, 8
push ecx
mov bl, al
call dword [sym.imp.SHELL32.dll_ILFree]
mov al, bl
pop ebx
add esp, 8
ret
mov al, byte [esp + 3]
add esp, 8
ret

Function at 0x42f010
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x44658d
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x453140]
xor eax, esp
mov dword [esp + 0x230], eax
push ebx
push esi
push edi
mov eax, dword [0x453140]
xor eax, esp
push eax
lea eax, [esp + 0x244]
mov dword fs:[0], eax
mov esi, dword [esp + 0x254]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
mov dword [esp + 0x18], esi
mov word [esi + 4], bx
mov dword [esp + 0x24c], ebx
mov dword [esp + 0x14], 1
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [eax + 0x447624]
mov word [esp + eax + 0x38], cx
add eax, 2
cmp cx, bx
jne 0x42f080
mov edi, dword [esp + 0x258]
push ebx
push edi
lea eax, [esp + 0x40]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x42f0d2
lea eax, [esp + 0x38]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x42f0b4
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x3c]
push ecx
mov ecx, esi
call fcn.00401cc0
jmp 0x42f126
lea edx, [esp + 0x10]
push edx
push edi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.0042ea50
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov dword [esp + 0x258], 1
call fcn.00401bd0
cmp dword [esp + 0x34], 8
jb 0x42f11b
mov edx, dword [esp + 0x20]
push edx
call fcn.004317a4
add esp, 4
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.SHELL32.dll_ILFree]
mov eax, esi
mov ecx, dword [esp + 0x244]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x230]
xor ecx, esp
call fcn.004320c7
add esp, 0x240
ret
Function at 0x42fe90
Capabilities:
Check os version

Disassembly:
sub esp, 0x148
mov eax, dword [0x453140]
xor eax, esp
mov dword [esp + 0x144], eax
push ebx
push ebp
mov ebp, dword [esp + 0x154]
push esi
push edi
push 0x114
xor ebx, ebx
lea eax, [esp + 0x44]
push ebx
push eax
mov edi, ecx
xor esi, esi
call fcn.00431940
add esp, 0xc
lea ecx, [esp + 0x40]
push ecx
mov dword [esp + 0x44], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x44], 6
jb 0x42ff8e
xor eax, eax
push 1
lea edx, [esp + 0x2c]
push edx
mov byte [esp + 0x30], bl
mov dword [esp + 0x31], eax
mov dword [esp + 0x35], eax
mov dword [esp + 0x39], eax
mov dword [esp + 0x3d], eax
mov word [esp + 0x41], ax
mov byte [esp + 0x43], al
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push ebx
push ebx
push 1
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push ebx
lea edx, [esp + 0x24]
push edx
xor eax, eax
push 1
lea ecx, [esp + 0x34]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push str.S:_ML__NW___LW_
mov dword [esp + 0x24], 0xc
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ecx
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
lea eax, [esp + 0x3c]
push eax
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x4c], ebx
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorSacl]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
push ebx
push ecx
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorSacl]
lea esi, [esp + 0x14]
push ebp
push ebx
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [esp + 0x154]
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004320c7
add esp, 0x148
ret 4