joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421782
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push 0x24c
mov eax, 0x47951f
call fcn.00442c61
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x214]
call fcn.00409bbf
lea eax, [ebp - 0x214]
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.00420f62
mov ebx, dword [ebp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop ecx
lea ecx, [ebp - 0x218]
push ecx
mov ecx, ebx
or ecx, 0x20019
push ecx
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x230], eax
push eax
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x218], esi
call edi
cmp eax, esi
je 0x42180e
jle 0x4217f7
and eax, 0xffff
or eax, 0x80070000
mov ecx, dword [ebp - 0x214]
add ecx, 0xfffffff0
mov esi, eax
call fcn.0040125c
mov eax, esi
jmp 0x421977
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x22c]
push eax
push esi
lea eax, [ebp - 0x234]
push eax
push esi
push dword [ebp - 0x218]
mov dword [ebp - 0x234], 0x104
mov dword [ebp - 0x22c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x21c], eax
cmp eax, esi
je 0x42188e
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x21c]
cmp eax, esi
jmp 0x4217eb
xor eax, eax
push 0x1fe
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push esi
push eax
call fcn.004424b0
add esp, 0xc
push esi
push esi
lea eax, [ebp - 0x238]
push eax
push esi
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x228], 0x100
push dword [ebp - 0x218]
mov dword [ebp - 0x238], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push dword [ebp - 0x218]
mov dword [ebp - 0x21c], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x21c]
cmp eax, esi
jne 0x4217eb
lea eax, [ebp - 0x224]
push eax
or ebx, 0x20006
push ebx
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x224], esi
push dword [ebp - 0x230]
call edi
cmp eax, esi
jne 0x4217eb
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, esi
je 0x421957
jle 0x421951
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x220], eax
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x214]
add ecx, 0xfffffff0
call fcn.0040125c
mov eax, dword [ebp - 0x220]
call fcn.00442ce4
ret
Function at 0x422596
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x228
mov eax, 0x479662
call fcn.00442c61
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x228], ebx
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x230], edi
cmp dword [eax - 0xc], ebx
jne 0x42270b
mov edi, str.BEE0D90A11F14E609C6B8FFD17FE3F24
push edi
lea ecx, [ebp - 0x21c]
call fcn.00409bbf
lea eax, [ebp - 0x220]
push eax
push 0x20019
push ebx
push str.SoftwarePPTAssistCommon
push reloc.WS2_32.dll_accept
mov dword [ebp - 4], ebx
mov dword [ebp - 0x220], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x4226e4
cmp dword [ebp - 0x220], ebx
je 0x4226e4
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
mov dword [ebp - 0x234], ebx
call fcn.004424b0
add esp, 0xc
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x234]
push eax
push ebx
push str.infoGUID
push dword [ebp - 0x220]
mov dword [ebp - 0x22c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x42267e
push edi
call fcn.0044252a
pop ecx
push eax
push edi
lea ecx, [ebp - 0x21c]
call fcn.00404b8e
jmp 0x4226d8
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x224]
call fcn.00409bbf
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x228]
push eax
mov byte [ebp - 4], 1
call fcn.004224ed
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 2
call fcn.00414d17
mov ecx, dword [ebp - 0x228]
add ecx, 0xfffffff0
call fcn.0040125c
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.0040125c
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [esi + 0x10]
call fcn.00414d17
mov ecx, dword [ebp - 0x21c]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.0040125c
mov edi, dword [ebp - 0x230]
mov eax, dword [esi + 0x10]
sub eax, 0x10
push eax
call fcn.00402607
add eax, 0x10
mov dword [edi], eax
pop ecx
mov eax, edi
call fcn.00442ce4
ret 4
Function at 0x422727
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x220
mov eax, 0x479695
call fcn.00442c61
mov ebx, dword [ebp + 8]
xor edi, edi
mov esi, ecx
mov dword [ebp - 0x224], edi
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x22c], ebx
cmp dword [eax - 0xc], edi
jne 0x422857
mov ebx, str.0.0.0.X
push ebx
lea ecx, [ebp - 0x21c]
call fcn.00409bbf
lea eax, [ebp - 0x220]
push eax
push 0x20019
push edi
push str.SoftwarePPTAssistCommon
push reloc.WS2_32.dll_accept
mov dword [ebp - 4], edi
mov dword [ebp - 0x220], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x422830
cmp dword [ebp - 0x220], edi
je 0x422830
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
mov dword [ebp - 0x224], edi
call fcn.004424b0
add esp, 0xc
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x224]
push eax
push edi
push str.Version
push dword [ebp - 0x220]
mov dword [ebp - 0x228], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
je 0x422804
push ebx
call fcn.0044252a
pop ecx
push eax
push ebx
jmp 0x422819
lea eax, [ebp - 0x218]
push eax
call fcn.0044252a
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.00404b8e
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [esi + 0x14]
call fcn.00414d17
mov ecx, dword [ebp - 0x21c]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.0040125c
mov ebx, dword [ebp - 0x22c]
mov eax, dword [esi + 0x14]
sub eax, 0x10
push eax
call fcn.00402607
add eax, 0x10
mov dword [ebx], eax
pop ecx
mov eax, ebx
call fcn.00442ce4
ret 4
Function at 0x422873
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x224
mov eax, 0x4796f4
call fcn.00442c61
mov esi, dword [ebp + 8]
xor edi, edi
mov ebx, ecx
mov dword [ebp - 0x228], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x230], esi
cmp dword [eax - 0xc], edi
jne 0x422aa2
mov esi, 0x47f918
push esi
lea ecx, [ebp - 0x21c]
call fcn.00409bbf
lea eax, [ebp - 0x22c]
push eax
push 0x20019
push edi
push str.SoftwarePPTAssistCommon
push reloc.WS2_32.dll_accept
mov dword [ebp - 4], edi
mov dword [ebp - 0x22c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x42297c
cmp dword [ebp - 0x22c], edi
je 0x42297c
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
mov dword [ebp - 0x224], edi
call fcn.004424b0
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x224]
push eax
push edi
push str.DistSrc
push dword [ebp - 0x22c]
mov dword [ebp - 0x220], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
je 0x422950
push esi
call fcn.0044252a
pop ecx
push eax
push esi
jmp 0x422965
lea eax, [ebp - 0x218]
push eax
call fcn.0044252a
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.00404b8e
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x498d34
push esi
lea ecx, [ebp - 0x220]
call fcn.00421c6c
push esi
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 1
call fcn.00421c6c
mov eax, dword [ebp - 0x21c]
mov esi, dword [eax - 0xc]
push edi
push 0x2e
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 2
call fcn.00420ec4
mov edi, eax
cmp edi, 0xffffffff
je 0x422a5f
push edi
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x21c]
call fcn.00420ef8
push eax
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 3
call fcn.00414d17
mov ecx, dword [ebp - 0x228]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.0040125c
sub esi, edi
push esi
inc edi
push edi
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x21c]
call fcn.00414c8b
push eax
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 4
call fcn.00414d17
mov ecx, dword [ebp - 0x228]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.0040125c
push dword [ebp - 0x220]
call fcn.0044a354
push dword [ebp - 0x224]
mov esi, eax
call fcn.0044a354
push eax
push esi
lea eax, [ebp - 0x21c]
push str._d._d
push eax
call fcn.00408d3e
add esp, 0x18
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebx + 0x18]
call fcn.00414d17
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.0040125c
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.0040125c
mov ecx, dword [ebp - 0x21c]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.0040125c
mov esi, dword [ebp - 0x230]
mov eax, dword [ebx + 0x18]
sub eax, 0x10
push eax
call fcn.00402607
add eax, 0x10
mov dword [esi], eax
pop ecx
mov eax, esi
call fcn.00442ce4
ret 4
Function at 0x422c94
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
xor edi, edi
xor eax, eax
mov dword [ebp - 4], edi
cmp dword [ebp + 0xc], edi
jbe 0x422d8e
mov ecx, dword [ebp + 8]
push ebx
mov dword [ebp - 8], 1
sub dword [ebp - 8], ecx
mov dword [ebp - 0xc], 2
sub dword [ebp - 0xc], ecx
push esi
mov esi, dword [ebp + 0x10]
jmp 0x422ccc
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
add edi, ecx
movzx ecx, byte [edi]
shr ecx, 2
mov cl, byte [ecx + 0x481610]
mov byte [eax + esi], cl
mov cl, byte [edi]
and cl, 3
add edx, edi
shl cl, 4
cmp edx, dword [ebp + 0xc]
jae 0x422d63
mov ebx, dword [ebp - 4]
mov edx, dword [ebp + 8]
lea edx, [ebx + edx + 1]
mov bl, byte [edx]
shr bl, 4
add bl, cl
movzx ecx, bl
mov cl, byte [ecx + 0x481610]
mov byte [eax + esi + 1], cl
mov cl, byte [edx]
mov edx, dword [ebp - 0xc]
and cl, 0xf
add edx, edi
shl cl, 2
cmp edx, dword [ebp + 0xc]
jae 0x422d4f
mov edx, dword [ebp - 4]
mov edi, dword [ebp + 8]
mov dl, byte [edx + edi + 2]
mov bl, dl
and bl, 0x3f
shr dl, 6
add dl, cl
movzx ecx, dl
mov cl, byte [ecx + 0x481610]
mov byte [eax + esi + 2], cl
movzx ecx, bl
mov cl, byte [ecx + 0x481610]
mov byte [eax + esi + 3], cl
jmp 0x422d77
movzx ecx, cl
mov cl, byte [ecx + 0x481610]
mov byte [eax + esi + 2], cl
mov byte [eax + esi + 3], 0x3d
jmp 0x422d77
movzx ecx, cl
mov cl, byte [ecx + 0x481610]
mov byte [eax + esi + 1], cl
mov word [eax + esi + 2], 0x3d3d
mov edi, dword [ebp - 4]
add edi, 3
add eax, 4
mov dword [ebp - 4], edi
cmp edi, dword [ebp + 0xc]
jb 0x422cc9
pop esi
pop ebx
pop edi
leave
ret

Function at 0x422d91
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
sub esp, 0xc
cmp byte [ecx + eax - 1], 0x3d
jne 0x422daf
dec eax
cmp byte [ecx + eax - 1], 0x3d
je 0x422da4
mov dword [ebp + 0xc], eax
push esi
xor esi, esi
mov dword [ebp - 4], esi
cmp eax, esi
jbe 0x422e61
push ebx
mov dword [ebp - 8], 2
sub dword [ebp - 8], ecx
mov dword [ebp - 0xc], 3
sub dword [ebp - 0xc], ecx
push edi
mov edi, dword [ebp + 0x10]
movsx eax, byte [ecx + 1]
movsx edx, byte [ecx]
mov al, byte [eax + 0x47f940]
mov dl, byte [edx + 0x47f940]
shl dl, 2
mov bl, al
sar bl, 4
and bl, 3
or dl, bl
mov byte [esi + edi], dl
mov edx, dword [ebp - 8]
add edx, ecx
inc esi
cmp edx, dword [ebp + 0xc]
jae 0x422e4c
mov ebx, dword [ebp + 8]
mov edx, dword [ebp - 4]
movsx edx, byte [edx + ebx + 2]
mov dl, byte [edx + 0x47f940]
mov bl, dl
sar bl, 2
shl al, 4
and bl, 0xf
or bl, al
mov eax, dword [ebp - 0xc]
mov byte [esi + edi], bl
add eax, ecx
inc esi
cmp eax, dword [ebp + 0xc]
jae 0x422e4c
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 8]
movsx eax, byte [eax + ebx + 3]
mov al, byte [eax + 0x47f940]
and al, 0x3f
shl dl, 6
or al, dl
mov byte [esi + edi], al
inc esi
add dword [ebp - 4], 4
mov eax, dword [ebp - 4]
add ecx, 4
cmp eax, dword [ebp + 0xc]
jb 0x422dd6
pop edi
pop ebx
mov eax, esi
pop esi
leave
ret
Function at 0x422e66
Capabilities:
Resume thread

Disassembly:
push esi
lea esi, [ecx + 0x6a0]
cmp dword [esi], 0
je 0x422e81
push dword [ecx + 0x67c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
and dword [esi], 0
pop esi
ret
Function at 0x423333
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x498d74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x28]
mov edx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x18]
push edi
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x20]
mov dword [ebp - 0x220], ebx
xor ebx, ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x208], ebx
lea ebx, [ebp - 0x208]
push ebx
lea ebx, [ebp - 0x214]
push ebx
lea ebx, [ebp - 0x218]
push ebx
push dword [ebp + 0x1c]
mov dword [ebp - 0x20c], ecx
mov ecx, dword [ebp + 0xc]
push esi
push dword [ebp + 0x14]
push edx
push 0x4800b8
push ecx
mov ecx, dword [ebp - 0x20c]
push eax
call fcn.00422fa2
test eax, eax
jne 0x4233d4
mov ecx, dword [ebp - 0x20c]
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x214]
push eax
mov eax, ebx
push eax
call fcn.00422f01
mov eax, 0x80004005
jmp 0x4234b3
xor eax, eax
push 0x1fe
mov word [ebp - 0x204], ax
xor ebx, ebx
lea eax, [ebp - 0x202]
push ebx
push eax
call fcn.004424b0
add esp, 0xc
push ebx
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x204]
push eax
push 5
push dword [ebp - 0x208]
mov dword [ebp - 0x224], 0x100
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x4233ca
cmp edi, ebx
je 0x423491
mov esi, dword [ebp + 0x24]
cmp esi, ebx
jbe 0x423491
lea eax, [ebp - 0x204]
push eax
call fcn.0044a354
pop ecx
mov dword [ebp - 0x21c], eax
cmp eax, esi
jbe 0x423447
mov dword [ebp - 0x21c], esi
xor esi, esi
mov dword [ebp - 0x210], ebx
lea eax, [ebp - 0x210]
push eax
push 0x400
lea eax, [edi + esi]
push eax
push dword [ebp - 0x208]
call dword [sym.imp.WININET.dll_InternetReadFile]
add esi, dword [ebp - 0x210]
cmp eax, ebx
je 0x423485
cmp dword [ebp - 0x210], ebx
je 0x423485
cmp esi, dword [ebp - 0x21c]
jb 0x42344f
mov eax, dword [ebp - 0x220]
cmp eax, ebx
je 0x423491
mov dword [eax], esi
mov ecx, dword [ebp - 0x20c]
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00422f01
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044249e
leave
ret 0x24

Function at 0x4237ef
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x498d74]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.004424b0
push 0
push 0x104
lea eax, [ebp - 0x210]
push eax
push str.HKEY_CURRENT_USERSoftwareClassesCLSID034DF736_A378_4292_ACAE_A561088999F5InprocServer32_
call fcn.00421182
add esp, 0x1c
test eax, eax
js 0x423851
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x423851
xor al, al
jmp 0x423853
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044249e
leave
ret
Function at 0x42385f
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x498d74]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.004424b0
push 0x100
push 0x104
lea eax, [ebp - 0x210]
push eax
push str.HKEY_CURRENT_USERSoftwareClassesCLSID034DF736_A378_4292_ACAE_A561088999F5InprocServer32_
call fcn.00421182
add esp, 0x1c
test eax, eax
js 0x4238c4
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4238c4
xor al, al
jmp 0x4238c6
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044249e
leave
ret

Function at 0x423cbc
Capabilities:
Check if file exists
Get common file path

Disassembly:
push 0x210
mov eax, 0x4797f0
call fcn.00442c61
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x423ce2
inc eax
jmp 0x423da0
push esi
lea ecx, [ebp - 0x21c]
call fcn.00409bbf
and dword [ebp - 4], 0
mov esi, 0x480884
push esi
call fcn.0044252a
pop ecx
push eax
push esi
lea ecx, [ebp - 0x21c]
call fcn.00404a2c
push ebx
lea ecx, [ebp - 0x21c]
call fcn.00408be1
mov esi, 0x47ddd8
push esi
call fcn.0044252a
pop ecx
push eax
push esi
lea ecx, [ebp - 0x21c]
call fcn.00404a2c
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.004424b0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x218]
push str.System32_regsvr32.exe
push eax
call fcn.00442dc3
push dword [ebp + 0x14]
lea eax, [ebp - 0x218]
push 0
push dword [ebp + 0x10]
push 0
push dword [ebp - 0x21c]
push eax
call fcn.004015ca
mov ecx, dword [ebp - 0x21c]
add esp, 0x20
add ecx, 0xfffffff0
call fcn.0040125c
xor eax, eax
call fcn.00442ce4
ret
Function at 0x423f5a
Capabilities:
Check if file exists

Disassembly:
push 0x484
mov eax, 0x479889
call fcn.00442c61
xor edi, edi
push edi
mov esi, str.HKEY_CURRENT_USERSoftwareClassesCLSID034DF736_A378_4292_ACAE_A561088999F5InprocServer32_
push esi
call fcn.004213f9
pop ecx
pop ecx
test al, al
je 0x424034
xor eax, eax
push 0x208
mov word [ebp - 0x280], ax
lea eax, [ebp - 0x27e]
push edi
push eax
call fcn.004424b0
push edi
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x280]
push eax
push esi
call fcn.00421182
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x1c
lea eax, [ebp - 0x280]
push eax
call edi
test eax, eax
je 0x424034
push 0
push str.HKEY_CURRENT_USERSoftwareClassesPPTAssist.ControlCLSID_
call fcn.004213f9
pop ecx
pop ecx
test al, al
je 0x424034
xor eax, eax
push 0x62
push eax
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push eax
call fcn.004424b0
push 0
push 0x32
lea eax, [ebp - 0x74]
push eax
push str.HKEY_CURRENT_USERSoftwareClassesPPTAssist.ControlCLSID_
call fcn.00421182
add esp, 0x1c
push str.1077138E_896C_445E_BD31_CFCFFA4636C4
lea ecx, [ebp - 0x490]
call fcn.00409bbf
and dword [ebp - 4], 0
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x490]
call fcn.0042058f
test eax, eax
je 0x42403c
mov ecx, dword [ebp - 0x490]
add ecx, 0xfffffff0
call fcn.0040125c
xor al, al
call fcn.00442ce4
ret
push 0
push str.HKEY_CURRENT_USERSoftwareClassesCLSID1077138E_896C_445E_BD31_CFCFFA4636C4InprocServer32_
call fcn.004213f9
pop ecx
pop ecx
test al, al
je 0x424026
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x48c], ax
lea eax, [ebp - 0x48a]
push eax
call fcn.004424b0
push 0
push ebx
lea eax, [ebp - 0x48c]
push eax
push esi
call fcn.00421182
add esp, 0x1c
lea eax, [ebp - 0x48c]
push eax
call edi
mov ecx, dword [ebp - 0x490]
add ecx, 0xfffffff0
test eax, eax
je 0x42402f
call fcn.0040125c
mov al, 1
jmp 0x424036
Function at 0x42409b
Capabilities:
Check if file exists

Disassembly:
push 0x484
mov eax, 0x479889
call fcn.00442c61
push 0
mov edi, str.HKEY_CURRENT_USERSoftwareClassesCLSID034DF736_A378_4292_ACAE_A561088999F5InprocServer32_
push edi
call fcn.004213f9
pop ecx
pop ecx
test al, al
je 0x424177
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x280], ax
lea eax, [ebp - 0x27e]
push eax
call fcn.004424b0
mov esi, 0x100
push esi
push 0x104
lea eax, [ebp - 0x280]
push eax
push edi
call fcn.00421182
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x1c
lea eax, [ebp - 0x280]
push eax
call ebx
test eax, eax
je 0x424177
push 0
push str.HKEY_CURRENT_USERSoftwareClassesPPTAssist.ControlCLSID_
call fcn.004213f9
pop ecx
pop ecx
test al, al
je 0x424177
xor eax, eax
push 0x62
push eax
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push eax
call fcn.004424b0
push esi
push 0x32
lea eax, [ebp - 0x74]
push eax
push str.HKEY_CURRENT_USERSoftwareClassesPPTAssist.ControlCLSID_
call fcn.00421182
add esp, 0x1c
push str.1077138E_896C_445E_BD31_CFCFFA4636C4
lea ecx, [ebp - 0x490]
call fcn.00409bbf
and dword [ebp - 4], 0
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x490]
call fcn.0042058f
test eax, eax
je 0x42417f
mov ecx, dword [ebp - 0x490]
add ecx, 0xfffffff0
call fcn.0040125c
xor al, al
call fcn.00442ce4
ret
push esi
push str.HKEY_CURRENT_USERSoftwareClassesCLSID1077138E_896C_445E_BD31_CFCFFA4636C4InprocServer32_
call fcn.004213f9
pop ecx
pop ecx
test al, al
je 0x424169
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x48c], ax
lea eax, [ebp - 0x48a]
push eax
call fcn.004424b0
push esi
push 0x104
lea eax, [ebp - 0x48c]
push eax
push edi
call fcn.00421182
add esp, 0x1c
lea eax, [ebp - 0x48c]
push eax
call ebx
mov ecx, dword [ebp - 0x490]
add ecx, 0xfffffff0
test eax, eax
je 0x424172
call fcn.0040125c
mov al, 1
jmp 0x424179
Function at 0x424529
Capabilities:
Enumerate processes

Disassembly:
push 0x458
mov eax, 0x479938
call fcn.00442c61
mov edi, dword [ebp + 8]
call fcn.00423794
xor ebx, ebx
push str.psapi.dll
mov dword [ebp - 0x464], eax
mov dword [ebp - 0x454], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x458], eax
cmp eax, ebx
je 0x424736
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetProcessImageFileNameW
push eax
call esi
push str.GetModuleFileNameExW
push dword [ebp - 0x458]
mov dword [ebp - 0x45c], eax
call esi
push ebx
push 2
mov dword [ebp - 0x460], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, 0x22c
push esi
mov dword [ebp - 0x450], eax
lea eax, [ebp - 0x444]
push ebx
push eax
call fcn.004424b0
add esp, 0xc
push edi
lea ecx, [ebp - 0x448]
mov dword [ebp - 0x444], esi
call fcn.00409bbf
push ebx
push 0x47dfec
lea ecx, [ebp - 0x448]
mov dword [ebp - 4], ebx
call fcn.00421c32
mov ecx, dword [ebp - 0x448]
mov ecx, dword [ecx - 0xc]
sub ecx, eax
push ecx
lea eax, [ebp - 0x44c]
push eax
lea ecx, [ebp - 0x448]
call fcn.00423b06
push eax
lea ecx, [ebp - 0x448]
mov byte [ebp - 4], 1
call fcn.00414d17
mov ecx, dword [ebp - 0x44c]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.0040125c
lea ecx, [ebp - 0x448]
call fcn.00421e66
lea eax, [ebp - 0x444]
push eax
push dword [ebp - 0x450]
call sub.KERNEL32.dll_Process32FirstW
cmp eax, ebx
je 0x424710
mov esi, 0x104
push dword [ebp - 0x43c]
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebx
je 0x4246ef
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.004424b0
add esp, 0xc
push esi
lea eax, [ebp - 0x218]
push eax
cmp dword [ebp - 0x464], ebx
jne 0x424695
push ebx
push edi
call dword [ebp - 0x460]
jmp 0x42469c
push edi
call dword [ebp - 0x45c]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x44c]
call fcn.00409bbf
lea ecx, [ebp - 0x44c]
mov byte [ebp - 4], 2
call fcn.00421e66
push ebx
push dword [ebp - 0x448]
lea ecx, [ebp - 0x44c]
call fcn.00421c32
cmp eax, 0xffffffff
jle 0x4246de
mov dword [ebp - 0x454], 1
mov ecx, dword [ebp - 0x44c]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.0040125c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x444]
push eax
push dword [ebp - 0x450]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x424641
push dword [ebp - 0x450]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x458]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x448]
add ecx, 0xfffffff0
call fcn.0040125c
mov eax, dword [ebp - 0x454]
call fcn.00442ce4
ret