joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425880
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x442f9c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0042d930
add esp, 8
test eax, eax
jne 0x4258af
mov eax, 0x80004005
jmp 0x425a36
push dword [ebp + 0x14]
call fcn.00429c50
add esp, 4
lea ecx, [ebp - 0x24]
mov esi, eax
mov dword [ebp - 8], esi
call fcn.0042dd50
mov ebx, dword [ebp + 0x18]
lea ecx, [ebp - 0x24]
push ebx
push esi
call fcn.0042e8f0
test al, al
jne 0x4258e2
mov esi, 1
jmp 0x425a2c
mov edi, dword [ebp + 0x20]
test edi, edi
jne 0x4258f1
lea esi, [edi + 0x57]
jmp 0x425a2c
cmp word [edi], 1
jne 0x425a27
cmp dword [edi + 4], 1
jne 0x425a27
cmp dword [edi + 0x14], 0
jne 0x425a27
lea eax, [ebp - 0x14]
push eax
push edi
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
mov esi, eax
test esi, esi
jne 0x425a2c
test ebx, ebx
je 0x42597d
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425930
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
mov dword [ebp - 0x10], eax
cmp eax, 0x3fffffff
jg 0x42597d
add eax, eax
call fcn.00434cf0
mov esi, esp
test esi, esi
je 0x42597d
mov ecx, dword [ebp - 0x10]
push 0
push 0
mov byte [esi], 0
lea eax, [ecx + ecx]
push eax
push esi
push 0xffffffffffffffff
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, esi
jmp 0x42597f
xor eax, eax
push 0
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x425a1c
mov esi, dword [ebp + 0x1c]
test esi, esi
je 0x4259fd
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4259b0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
mov dword [ebp - 8], eax
cmp eax, 0x3fffffff
jg 0x4259fd
add eax, eax
call fcn.00434cf0
mov ebx, esp
test ebx, ebx
je 0x4259fd
mov ecx, dword [ebp - 8]
push 0
push 0
mov byte [ebx], 0
lea eax, [ecx + ecx]
push eax
push ebx
push 0xffffffffffffffff
push esi
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, ebx
jmp 0x4259ff
xor eax, eax
push dword [edi + 0x10]
push dword [ebp - 0x14]
push 3
push 0
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
xor esi, esi
jmp 0x425a2c
mov esi, 0x80004005
lea ecx, [ebp - 0x24]
call fcn.0042df70
mov eax, esi
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434750
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x425a50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x442f9c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0042d930
add esp, 8
test eax, eax
jne 0x425a7f
mov eax, 0x80004005
jmp 0x425c35
mov esi, dword [ebp + 0x20]
test esi, esi
je 0x425ad9
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425a90
sub ecx, edx
sar ecx, 1
lea ebx, [ecx + 1]
cmp ebx, 0x3fffffff
jg 0x425ad9
add ebx, ebx
mov eax, ebx
call fcn.00434cf0
mov edi, esp
test edi, edi
je 0x425ad9
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push esi
push 0
push 3
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
neg esi
sbb esi, esi
and esi, edi
jmp 0x425adb
xor esi, esi
push dword [ebp + 0x14]
call fcn.00429c50
add esp, 4
lea ecx, [ebp - 0x20]
mov ebx, eax
mov dword [ebp - 0xc], ebx
call fcn.0042dd50
mov edi, dword [ebp + 0x18]
lea ecx, [ebp - 0x20]
push edi
push ebx
call fcn.0042e8f0
test al, al
jne 0x425b0e
mov esi, 1
jmp 0x425c2b
test edi, edi
je 0x425b6a
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425b17
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
mov dword [ebp - 8], eax
cmp eax, 0x3fffffff
jg 0x425b6a
add eax, eax
call fcn.00434cf0
mov ebx, esp
test ebx, ebx
je 0x425b67
mov ecx, dword [ebp - 8]
push 0
push 0
mov byte [ebx], 0
lea eax, [ecx + ecx]
push eax
push ebx
push 0xffffffffffffffff
push edi
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, ebx
mov ebx, dword [ebp - 0xc]
jmp 0x425b6c
mov ebx, dword [ebp - 0xc]
xor eax, eax
push 0
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x425c29
mov edi, dword [ebp + 0x1c]
test edi, edi
je 0x425bef
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425ba0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
mov dword [ebp - 8], eax
cmp eax, 0x3fffffff
jg 0x425bef
add eax, eax
call fcn.00434cf0
mov ebx, esp
test ebx, ebx
je 0x425bef
mov ecx, dword [ebp - 8]
push 0
push 0
mov byte [ebx], 0
lea eax, [ecx + ecx]
push eax
push ebx
push 0xffffffffffffffff
push edi
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, ebx
jmp 0x425bf1
xor ecx, ecx
xor eax, eax
test esi, esi
je 0x425c0f
cmp byte [eax + esi], 0
je 0x425c05
inc eax
cmp eax, 0x7fffffff
jb 0x425bf7
mov edx, SysReAllocString
cmp eax, edx
cmove eax, edx
inc eax
push eax
push esi
push 3
push 0
push ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
lea ecx, [ebp - 0x20]
call fcn.0042df70
mov eax, esi
lea esp, [ebp - 0x2c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434750
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4276a0
Capabilities:
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0042d930
add esp, 8
test eax, eax
jne 0x4276c3
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp - 0x2c]
push ebx
push esi
xor esi, esi
push edi
mov dword [eax], esi
call fcn.0042dd50
mov ebx, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
test bl, 6
je 0x4276f4
push esi
push 1
push edi
lea ecx, [ebp - 0x2c]
call fcn.0042ea90
test al, al
je 0x427891
test edi, edi
je 0x427891
cmp word [edi], si
je 0x427891
mov ecx, edi
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x427710
sub ecx, edx
sar ecx, 1
cmp word [edi + ecx*2 - 2], 0x2e
je 0x427891
test bl, 4
je 0x427741
mov edx, 0xc0000000
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], 2
jmp 0x42778d
test bl, 2
je 0x427771
mov eax, 0xc0000000
mov dword [ebp - 0xc], esi
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 3
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
and esi, 1
jne 0x427896
mov edx, 0xc0000000
jmp 0x427790
test bl, 1
je 0x427891
mov edx, SysReAllocString
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 3
mov dword [ebp - 0x10], edx
mov eax, ebx
and eax, 0x28
cmp al, 0x28
je 0x427891
mov ecx, ebx
mov eax, ebx
and ecx, 8
and eax, 0x20
add ecx, ecx
or ecx, eax
mov eax, 0x80
shl ecx, 0x17
test bl, 0x40
push 0
mov ebx, 0x4000100
cmovne eax, ebx
or ecx, eax
push ecx
push dword [ebp - 8]
mov dword [ebp - 0x14], ecx
push 0
push dword [ebp - 0xc]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x42784f
mov ebx, dword [ebp - 0x14]
test ebx, 0x10000000
je 0x42786d
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
cmp eax, 0xffffffff
jne 0x42780a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42786a
mov eax, dword [ebp - 0x14]
xor ecx, ecx
or ecx, dword [ebp - 0x18]
or eax, 0
mov dword [ebp - 0x18], eax
ja 0x427822
cmp ecx, 0xee6b280
jbe 0x42786a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
and ebx, 0xefffffff
push 0
push ebx
push dword [ebp - 8]
push 0
push dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x42786d
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.0042df70
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp - 4]
test eax, eax
je 0x427896
push dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 8]
add eax, 8
push eax
call fcn.0042a270
add esp, 0xc
test al, al
jne 0x427896
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 1
lea ecx, [ebp - 0x2c]
call fcn.0042df70
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x427980
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0042d930
add esp, 8
test eax, eax
je 0x427a3b
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [eax + 8]
call fcn.0042a330
add esp, 0xc
test al, al
je 0x427a2e
mov ebx, dword [ebp + 0x1c]
test ebx, ebx
je 0x427a2e
mov esi, dword [ebp + 0x20]
test esi, esi
je 0x427a2e
push dword [ebp + 0x18]
push 0
push 0x11
call dword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
mov dword [esi], eax
test eax, eax
je 0x427a3b
push edi
lea ecx, [ebp - 4]
xor edi, edi
push ecx
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
test eax, eax
jne 0x427a23
push eax
push ebx
push dword [ebp + 0x18]
mov dword [ebx], edi
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x427a09
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push dword [esi]
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
test edi, edi
je 0x427a23
push dword [esi]
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
mov dword [esi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
pop esi
mov eax, 0x57
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x427a50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0042d930
add esp, 8
test eax, eax
je 0x427af7
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [eax + 8]
call fcn.0042a330
add esp, 0xc
test al, al
je 0x427aea
mov ebx, dword [ebp + 0x1c]
test ebx, ebx
je 0x427aea
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x427aea
cmp word [esi], 1
jne 0x427af7
cmp dword [esi + 4], 1
jne 0x427af7
cmp dword [esi + 0x14], 0
jne 0x427af7
push edi
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
mov edi, eax
test edi, edi
jne 0x427ae1
push eax
push ebx
mov dword [ebx], eax
push dword [esi + 0x10]
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x427ad8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
pop esi
mov eax, 0x57
pop ebx
mov esp, ebp
pop ebp
ret 0x18
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x427b10
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0042d930
add esp, 8
test eax, eax
jne 0x427b31
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret 0x18
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
push dword [edi + 8]
call fcn.0042a330
add esp, 0xc
test al, al
jne 0x427b57
mov eax, 0x57
pop edi
mov esp, ebp
pop ebp
ret 0x18
push esi
push dword [ebp + 0x1c]
mov esi, dword [edi]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
mov esi, dword [esi + 0x60]
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [0x438430]
call esi
pop esi
test eax, eax
jne 0x427b8a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb eax, eax
inc eax
pop edi
mov esp, ebp
pop ebp
ret 0x18

Function at 0x427ba0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push dword [ebp + 0x10]
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
call fcn.0042d930
add esp, 8
test eax, eax
jne 0x427bca
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret 0x1c
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [eax + 8]
call fcn.0042a330
add esp, 0xc
test al, al
jne 0x427bee
mov eax, 0x57
mov esp, ebp
pop ebp
ret 0x1c
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, eax
cmp edx, 0xffffffff
jne 0x427c0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esp, ebp
pop ebp
ret 0x1c
cmp dword [ebp + 0x20], 0
jne 0x427c29
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
xor eax, eax
mov esp, ebp
pop ebp
ret 0x1c
cmp dword [ebp - 4], 0
jne 0x427c44
cmp edx, 0x7fffffff
ja 0x427c44
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
xor eax, eax
mov esp, ebp
pop ebp
ret 0x1c
mov eax, 1
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x427c50
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0042d930
add esp, 8
test eax, eax
jne 0x427c73
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret 0x10
push esi
push edi
mov edi, dword [ebp + 0x14]
xor esi, esi
test edi, edi
je 0x427cce
lea ecx, [ebp - 0x10]
call fcn.0042dd50
push esi
push 1
push edi
lea ecx, [ebp - 0x10]
call fcn.0042ea90
test al, al
jne 0x427ca9
lea ecx, [ebp - 0x10]
call fcn.0042df70
pop edi
lea eax, [esi + 1]
pop esi
mov esp, ebp
pop ebp
ret 0x10
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x427cbc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [ebp - 0x10]
call fcn.0042df70
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov esi, 1
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x427ce0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
push ebx
push edi
call fcn.0042d930
add esp, 8
test eax, eax
jne 0x427d09
pop edi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [ebp - 0x10]
call fcn.0042dd50
push 0
push 1
push dword [ebp + 0x18]
lea ecx, [ebp - 0x10]
call fcn.0042ea90
test al, al
je 0x427dcd
push 0
push 1
push dword [ebp + 0x1c]
lea ecx, [ebp - 0x10]
call fcn.0042ea90
test al, al
je 0x427dcd
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
push esi
mov esi, dword [eax]
push dword [ecx]
push ebx
mov esi, dword [esi + 0x30]
mov ecx, esi
push edi
push eax
call dword [0x438430]
call esi
mov edi, eax
test edi, edi
jne 0x427dba
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wrename]
mov ecx, dword [ebp + 8]
add esp, 8
mov edi, eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ecx]
push dword [ebp + 0x14]
push 1
mov esi, dword [esi + 0x2c]
test edi, edi
jne 0x427daa
push dword [ebp + 0x1c]
push ebx
push eax
push ecx
mov ecx, esi
call dword [0x438430]
call esi
pop esi
lea ecx, [ebp - 0x10]
mov edi, eax
call fcn.0042df70
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push dword [ebp + 0x18]
push ebx
push eax
push ecx
mov ecx, esi
call dword [0x438430]
call esi
pop esi
lea ecx, [ebp - 0x10]
call fcn.0042df70
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea ecx, [ebp - 0x10]
mov edi, 1
call fcn.0042df70
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x18

Function at 0x427eb0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0042d930
add esp, 8
test eax, eax
jne 0x427ed3
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret 0x10
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
test esi, esi
je 0x427f7d
lea ecx, [ebp - 0x10]
call fcn.0042dd50
push 1
push edi
push esi
lea ecx, [ebp - 0x10]
call fcn.0042ea90
test al, al
jne 0x427f0d
lea ecx, [ebp - 0x10]
call fcn.0042df70
lea eax, [edi + 1]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x427f12
sub ecx, edx
sar ecx, 1
je 0x427f66
movzx eax, word [esi + ecx*2 - 2]
cmp eax, 0x2e
je 0x427f66
cmp ecx, 1
jbe 0x427f3f
cmp word [esi + ecx*2 - 4], 0x2e
jne 0x427f3f
cmp eax, 0x5c
je 0x427f66
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x427f6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x10]
mov edi, eax
call fcn.0042df70
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov edi, 1
lea ecx, [ebp - 0x10]
call fcn.0042df70
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov edi, 1
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x427f90
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0042d930
add esp, 8
test eax, eax
jne 0x427fb3
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret 0x10
push esi
push edi
mov edi, dword [ebp + 0x14]
xor esi, esi
test edi, edi
je 0x42800d
lea ecx, [ebp - 0x10]
call fcn.0042dd50
push esi
push esi
push edi
lea ecx, [ebp - 0x10]
call fcn.0042ea90
test al, al
jne 0x427fe8
lea ecx, [ebp - 0x10]
call fcn.0042df70
pop edi
lea eax, [esi + 1]
pop esi
mov esp, ebp
pop ebp
ret 0x10
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x427ffb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [ebp - 0x10]
call fcn.0042df70
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov esi, 1
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x428640
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [eax + 8]
call fcn.0042a370
add esp, 0xc
test al, al
jne 0x428668
mov eax, 0x57
mov esp, ebp
pop ebp
ret 0x10
push 4
lea eax, [ebp + 0x14]
push eax
push 4
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x428690
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push ebx
push esi
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [eax + 8]
call fcn.0042a370
add esp, 0xc
test al, al
je 0x42877c
mov ebx, dword [ebp + 0x18]
test ebx, ebx
je 0x42877c
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x42877c
cmp word [esi], 1
jne 0x42876f
cmp dword [esi + 4], 1
jne 0x42876f
cmp dword [esi + 0x14], 0
jne 0x42876f
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
test eax, eax
jne 0x428781
cmp ebx, 2
jb 0x42876f
test bl, 1
jne 0x42876f
cmp dword [esi + 0x10], ebx
jne 0x42876f
mov edx, dword [ebp - 4]
cmp byte [edx + ebx - 2], al
jne 0x42876f
cmp byte [edx + ebx - 1], al
jne 0x42876f
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x428720
sub ecx, edi
sar ecx, 1
pop edi
lea eax, [ecx*2 + 2]
cmp eax, ebx
jne 0x42876f
push ebx
push edx
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x42875e
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push esi
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x14
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, 0x57
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x428790
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [eax + 8]
call fcn.0042a370
add esp, 0xc
test al, al
jne 0x4287ba
mov eax, 0x57
mov esp, ebp
pop ebp
ret 0x10
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4287f5
cmp dword [ebp - 0xc], 4
jne 0x4287f5
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x10]
mov dword [ecx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10

Function at 0x428800
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push esi
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [eax + 8]
call fcn.0042a370
add esp, 0xc
test al, al
je 0x4288bc
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x4288bc
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4288b0
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x4288a7
push eax
push 0
push 0x11
call dword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
mov dword [esi], eax
test eax, eax
jne 0x428879
mov eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret 0x14
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
test eax, eax
jne 0x4288a7
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esi]
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x14
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x14
mov eax, 0x57
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x4288d0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [eax + 8]
call fcn.0042a370
add esp, 0xc
test al, al
jne 0x4288f8
mov eax, 0x57
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc