joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cc24
Capabilities:
Get common file path

Disassembly:
push 0x210
mov eax, 0x4d614c
call fcn.004b6799
xor edi, edi
lea esi, [ebx + 0x2018]
mov dword [ebx], vtable.CCategory.0
mov dword [ebx + 0x2004], edi
mov dword [ebx + 0x2008], edi
mov dword [ebx + 0x200c], edi
mov dword [ebx + 0x2010], edi
mov dword [ebx + 0x2014], edi
mov dword [ebp - 0x21c], ebx
mov dword [esi], vtable.CArray_class_CProblem___class_CProblem__const_const__.0
mov dword [esi + 4], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0xc], edi
mov dword [esi + 8], edi
lea ecx, [ebx + 0x202c]
mov dword [ebp - 4], edi
call fcn.00402827
push 0x2000
lea eax, [ebx + 4]
push edi
push eax
mov byte [ebp - 4], 1
call fcn.004b62d0
add esp, 0xc
mov eax, 0x104
push eax
push eax
lea ecx, [ebx + 0x202c]
call fcn.0040294d
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0xffffffffffffffff
lea ecx, [ebx + 0x202c]
call fcn.004123c7
push 0x530c3c
lea ecx, [ebx + 0x202c]
call fcn.00411f5d
cmp dword [0x579254], edi
jne 0x40ccf9
push str.GetSystemWow64DirectoryW
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x579254], eax
cmp eax, edi
je 0x40cd48
mov eax, dword [0x579258]
cmp dword [eax - 0xc], edi
jne 0x40cd48
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.004b62d0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [0x579254]
test eax, eax
je 0x40cd48
lea eax, [ebp - 0x218]
push eax
mov ecx, 0x579258
call fcn.0040272d
xor edi, edi
call fcn.00434f23
mov eax, ebx
call fcn.004b681c
ret
Function at 0x40ce15
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x34
mov eax, 0x4d6110
call fcn.004b6763
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x30], ebx
call fcn.0049cf06
lea eax, [ebp - 0x40]
push eax
push ebx
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [ebp - 0x24], ebx
jbe 0x40cf3f
push 0x3fc
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
call fcn.00490db6
pop ecx
mov dword [ebp - 0x1c], eax
call fcn.0045d184
mov byte [ebp - 0x15], al
mov dword [ebp - 0x28], ebx
movzx eax, word [ebp - 0x28]
cmp eax, dword [ebp - 0x24]
jae 0x40cf1f
lea ecx, [ebp - 0x40]
push ecx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x2c]
push ecx
push dword [ebp - 0x1c]
mov dword [ebp - 0x2c], 0xff
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
jne 0x40cf17
cmp byte [ebp - 0x15], bl
je 0x40cf08
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x20]
call fcn.0040254f
lea edi, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.00411ec6
mov ebx, edi
call fcn.0040c8c6
mov ebx, eax
call fcn.0040c913
push 0x530c50
xor ecx, ecx
mov esi, edi
call fcn.00407898
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
test eax, eax
jne 0x40cf01
call fcn.00402845
xor ebx, ebx
jmp 0x40cf17
call fcn.00402845
xor ebx, ebx
mov ecx, dword [ebp + 0xc]
push dword [ebp - 0x1c]
mov eax, dword [ecx + 8]
push eax
call fcn.0049d315
inc dword [ebp - 0x28]
jmp 0x40ce82
or dword [ebp - 4], 0xffffffff
jmp 0x40cf31
cmp dword [ebp - 0x1c], ebx
je 0x40cf3f
push dword [ebp - 0x1c]
call fcn.00490dab
pop ecx
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp dword [ecx + 8], ebx
setne al
call fcn.004b6808
ret
Function at 0x40cf50
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x4d3607
call fcn.004b6763
mov ecx, dword [ebp + 0xc]
xor esi, esi
push 0xffffffffffffffff
push esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
call fcn.0049cf06
lea eax, [ebp - 0x34]
push eax
push esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
push esi
lea eax, [ebp - 0x24]
push eax
push esi
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [ebp - 0x18], esi
jbe 0x40d024
mov ebx, 0x400
push 0x1000
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], esi
call fcn.00490db6
pop ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], esi
movzx edi, word [ebp - 0x1c]
cmp edi, dword [ebp - 0x18]
jae 0x40d004
push 0x800
push esi
push dword [ebp - 0x14]
call fcn.004b62d0
add esp, 0xc
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x20], ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, esi
jne 0x40cfff
mov ecx, dword [ebp + 0xc]
push dword [ebp - 0x14]
mov eax, dword [ecx + 8]
push eax
call fcn.0049d315
inc dword [ebp - 0x1c]
jmp 0x40cfba
or dword [ebp - 4], 0xffffffff
jmp 0x40d016
cmp dword [ebp - 0x14], esi
je 0x40d024
push dword [ebp - 0x14]
call fcn.00490dab
pop ecx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
call fcn.004b6808
ret 8
Function at 0x40d032
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x2c
mov eax, 0x4d60ed
call fcn.004b6763
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
push 0xffffffffffffffff
xor eax, eax
mov dword [ebp - 0x38], ebx
lea edi, [ebp - 0x34]
push ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
stosd dword es:[edi], eax
call fcn.0049cf06
lea eax, [ebp - 0x38]
push eax
push ebx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [ebp - 0x1c], ebx
jbe 0x40d163
push 0x3fc
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 0xff
mov dword [ebp - 4], ebx
call fcn.00490db6
mov esi, eax
pop ecx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], ebx
movzx edi, word [ebp - 0x18]
cmp edi, dword [ebp - 0x1c]
jae 0x40d143
push 0x1fe
push ebx
push esi
call fcn.004b62d0
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20]
push eax
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 0x20], 0xff
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, ebx
jne 0x40d13b
push esi
cmp word [ebp - 0x18], bx
jne 0x40d12f
lea ecx, [ebp - 0x14]
call fcn.0040254f
lea ebx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0040c913
call fcn.0040c8c6
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
je 0x40d11c
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 8]
push esi
push eax
call fcn.0049d315
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00402845
xor ebx, ebx
jmp 0x40d13b
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 8]
push eax
call fcn.0049d315
inc dword [ebp - 0x18]
jmp 0x40d0ac
or dword [ebp - 4], 0xffffffff
jmp 0x40d158
cmp esi, ebx
je 0x40d163
push esi
call fcn.00490dab
pop ecx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
call fcn.004b6808
ret 8

Function at 0x40d1cc
Capabilities:
Get file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or esi, 0xffffffff
cmp eax, esi
je 0x40d1e9
not al
movzx esi, al
shr esi, 4
and esi, 1
mov ecx, dword [esp + 8]
add ecx, 0xfffffff0
call fcn.00402845
mov eax, esi
pop esi
ret 4
Function at 0x40e5d9
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x4d4821
call fcn.004b6730
mov ebx, ecx
xor esi, esi
inc esi
mov dword [ebp - 4], esi
call fcn.0045d184
test al, al
je 0x40e613
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00402845
mov eax, esi
jmp 0x40e70f
and dword [ebp - 0x1c], 0
and dword [ebp - 0x18], 0
mov byte [ebp - 4], 2
mov esi, 0x104
mov ecx, ebx
mov dword [ebp - 0x10], esi
call fcn.0040264d
push dword [ebp + 0xc]
mov eax, 0x2001f
push dword [ebp + 8]
lea edi, [ebp - 0x1c]
call fcn.0041236b
mov dword [ebp - 0x14], eax
cmp eax, 5
jne 0x40e65c
push dword [ebp + 0xc]
mov eax, 0x20019
push dword [ebp + 8]
call fcn.0041236b
mov dword [ebp - 0x14], eax
xor edi, edi
cmp dword [ebp - 0x14], edi
jne 0x40e6e9
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp + 8]
push eax
push edi
push dword [ebp + 0x10]
mov dword [ebp - 0x10], esi
push dword [ebp - 0x1c]
mov dword [ebp + 8], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e6d8
cmp dword [ebp + 8], 1
je 0x40e693
cmp dword [ebp + 8], 2
jne 0x40e6d8
cmp dword [ebp - 0x10], esi
jbe 0x40e69b
mov esi, dword [ebp - 0x10]
push esi
mov ecx, ebx
call fcn.0040294d
push dword [ebp + 0x10]
lea ecx, [ebp - 0x1c]
push ecx
lea esi, [ebp - 0x10]
mov edi, eax
call fcn.00412303
push 0xffffffffffffffff
mov ecx, ebx
mov esi, eax
call fcn.004123c7
test esi, esi
jne 0x40e6d8
mov eax, dword [ebx]
cmp dword [eax - 0xc], esi
je 0x40e6df
call fcn.0040c8c6
mov ebx, eax
call fcn.0040c913
jmp 0x40e6df
mov ecx, ebx
call fcn.0040264d
lea ecx, [ebp - 0x1c]
call fcn.004123a7
xor edi, edi
lea ecx, [ebp - 0x1c]
call fcn.004123a7
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00402845
xor eax, eax
cmp dword [ebp - 0x14], edi
sete al
call fcn.004b6808
ret 0xc
Function at 0x40e717
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x4d47ee
call fcn.004b6730
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov ecx, dword [ebp + 0x14]
mov byte [ebp - 4], 2
mov esi, 0x104
mov dword [ebp - 0x14], esi
call fcn.0040264d
push dword [ebp + 0xc]
mov eax, 0x2021f
push dword [ebp + 8]
lea edi, [ebp - 0x20]
call fcn.0041236b
mov dword [ebp - 0x18], eax
cmp eax, 5
jne 0x40e770
push dword [ebp + 0xc]
mov eax, 0x20219
push dword [ebp + 8]
call fcn.0041236b
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jne 0x40e806
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp + 8]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp - 0x14], esi
push dword [ebp - 0x20]
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e7f6
cmp dword [ebp + 8], 1
je 0x40e7a5
cmp dword [ebp + 8], 2
jne 0x40e7f6
cmp dword [ebp - 0x14], esi
jbe 0x40e7ad
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x14]
push esi
call fcn.0040294d
push dword [ebp + 0x10]
lea ecx, [ebp - 0x20]
push ecx
lea esi, [ebp - 0x14]
mov edi, eax
call fcn.00412303
mov esi, dword [ebp + 0x14]
push 0xffffffffffffffff
mov ecx, esi
mov edi, eax
call fcn.004123c7
cmp edi, ebx
jne 0x40e7f2
mov eax, dword [esi]
cmp dword [eax - 0xc], ebx
je 0x40e7fe
mov ebx, esi
call fcn.0040c8c6
mov ebx, eax
call fcn.0040c913
xor ebx, ebx
jmp 0x40e7fe
mov ecx, esi
jmp 0x40e7f9
mov ecx, dword [ebp + 0x14]
call fcn.0040264d
lea ecx, [ebp - 0x20]
call fcn.004123a7
lea ecx, [ebp - 0x20]
call fcn.004123a7
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00402845
xor eax, eax
cmp dword [ebp - 0x18], ebx
sete al
call fcn.004b6808
ret 0x10
Function at 0x40e834
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x4d47ee
call fcn.004b6730
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov ecx, dword [ebp + 0x14]
mov byte [ebp - 4], 2
mov esi, 0x104
mov dword [ebp - 0x14], esi
call fcn.0040264d
push dword [ebp + 0xc]
mov eax, 0x2011f
push dword [ebp + 8]
lea edi, [ebp - 0x20]
call fcn.0041236b
mov dword [ebp - 0x18], eax
cmp eax, 5
jne 0x40e88d
push dword [ebp + 0xc]
mov eax, 0x20119
push dword [ebp + 8]
call fcn.0041236b
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jne 0x40e923
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp + 8]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp - 0x14], esi
push dword [ebp - 0x20]
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e913
cmp dword [ebp + 8], 1
je 0x40e8c2
cmp dword [ebp + 8], 2
jne 0x40e913
cmp dword [ebp - 0x14], esi
jbe 0x40e8ca
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x14]
push esi
call fcn.0040294d
push dword [ebp + 0x10]
lea ecx, [ebp - 0x20]
push ecx
lea esi, [ebp - 0x14]
mov edi, eax
call fcn.00412303
mov esi, dword [ebp + 0x14]
push 0xffffffffffffffff
mov ecx, esi
mov edi, eax
call fcn.004123c7
cmp edi, ebx
jne 0x40e90f
mov eax, dword [esi]
cmp dword [eax - 0xc], ebx
je 0x40e91b
mov ebx, esi
call fcn.0040c8c6
mov ebx, eax
call fcn.0040c913
xor ebx, ebx
jmp 0x40e91b
mov ecx, esi
jmp 0x40e916
mov ecx, dword [ebp + 0x14]
call fcn.0040264d
lea ecx, [ebp - 0x20]
call fcn.004123a7
lea ecx, [ebp - 0x20]
call fcn.004123a7
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00402845
xor eax, eax
cmp dword [ebp - 0x18], ebx
sete al
call fcn.004b6808
ret 0x10
Function at 0x40f05a
Capabilities:
Check if file exists

Disassembly:
push 4
mov eax, 0x4dbdf9
call fcn.004b6730
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.0040254f
and dword [ebp - 4], 0
mov edi, eax
call fcn.00411ec6
push eax
lea ecx, [ebp + 8]
call fcn.004022fa
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402845
cmp byte [ebp + 0xc], 0
jne 0x40f13a
mov edi, str._syswow64_
push edi
xor ecx, ecx
lea esi, [ebp + 8]
call fcn.00407898
cmp eax, 0xffffffff
je 0x40f110
mov eax, esi
push eax
lea ecx, [ebp + 0xc]
call fcn.004022fa
push str._system32_
push edi
lea eax, [ebp + 0xc]
push eax
mov byte [ebp - 4], 3
call fcn.00411d27
mov edi, dword [ebp + 0xc]
push edi
call fcn.004110fe
test eax, eax
jge 0x40f105
push dword [ebp + 8]
call fcn.004110fe
mov esi, eax
lea ecx, [edi - 0x10]
call fcn.00402845
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402845
mov eax, esi
call fcn.004b6808
ret 8
jne 0x40f0e6
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
jmp 0x40f0e6
mov ebx, str._system32_
push ebx
xor ecx, ecx
lea esi, [ebp + 8]
call fcn.00407898
cmp eax, 0xffffffff
je 0x40f13a
mov eax, esi
push eax
lea ecx, [ebp + 0xc]
call fcn.004022fa
mov byte [ebp - 4], 4
jmp 0x40f1a5
jne 0x40f0e8
jmp 0x40f107
mov edi, str.program_files__x86__
push edi
xor ecx, ecx
lea esi, [ebp + 8]
call fcn.00407898
cmp eax, 0xffffffff
je 0x40f181
mov eax, esi
push eax
lea ecx, [ebp + 0xc]
call fcn.004022fa
push str.program_files_
mov byte [ebp - 4], 5
push edi
lea eax, [ebp + 0xc]
push eax
call fcn.00411d27
mov edi, dword [ebp + 0xc]
push edi
call fcn.004110fe
mov esi, eax
test esi, esi
jge 0x40f136
jmp 0x40f0de
mov ebx, str.program_files_
push ebx
xor ecx, ecx
lea esi, [ebp + 8]
call fcn.00407898
cmp eax, 0xffffffff
je 0x40f1a9
mov eax, esi
push eax
lea ecx, [ebp + 0xc]
call fcn.004022fa
mov byte [ebp - 4], 6
push edi
push ebx
jmp 0x40f164
push dword [ebp + 8]
call fcn.004110fe
mov esi, eax
jmp 0x40f0f0
Function at 0x412303
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x412367
cmp dword [ebp + 0xc], 1
je 0x41233f
cmp dword [ebp + 0xc], 2
je 0x41233f
push 0xd
pop eax
jmp 0x412367
mov eax, dword [ebp - 4]
test edi, edi
je 0x412361
test eax, eax
je 0x41235c
test al, 1
jne 0x41233a
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x412361
jmp 0x41233a
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8
Function at 0x420a78
Capabilities:
Query environment variable

Disassembly:
push 0x41c
mov eax, 0x4d5d42
call fcn.004b6799
mov eax, dword [ebp + 8]
and dword [ebp - 0x424], 0
mov dword [ebp - 0x428], eax
and dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
cmp dword [eax - 0xc], 0xa
jl 0x420b5d
lea edi, [ebp + 0xc]
call fcn.00411ec6
mov edi, str._userprofile_
push edi
xor ecx, ecx
lea esi, [ebp + 0xc]
call fcn.00407898
cmp eax, 0xffffffff
je 0x420b5d
call fcn.0049219b
push eax
lea ecx, [ebp - 0x424]
call fcn.00402802
lea eax, [ebp - 0x424]
push eax
mov eax, dword [ebp - 0x428]
mov byte [ebp - 4], 1
push dword [eax + 0x2074]
lea ecx, [eax + 0x2044]
call fcn.004a059e
push 0x207
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x424]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x420b3f
xor eax, eax
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x424]
call fcn.0040272d
push dword [ebp - 0x424]
mov eax, esi
push edi
push eax
call fcn.00411d27
lea eax, [ebp - 0x424]
push eax
mov ecx, ebx
call fcn.004022fa
mov ecx, dword [ebp - 0x424]
add ecx, 0xfffffff0
call fcn.00402845
jmp 0x420b68
lea eax, [ebp + 0xc]
push eax
mov ecx, ebx
call fcn.004022fa
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00402845
mov eax, ebx
call fcn.004b681c
ret 8
Function at 0x42ae8a
Capabilities:
Persist via run registry key

Disassembly:
push 0xc
mov eax, 0x4d5cd1
call fcn.004b6730
mov esi, ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea ecx, [ebp - 0x10]
call fcn.0040254f
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.0045d184
lea edi, [esi + 0x2030]
test al, al
je 0x42af53
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Common_Programs
call fcn.0040254f
push ecx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
call fcn.004022fa
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], bl
call fcn.0040e834
cmp eax, ebx
je 0x42af17
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
cmp eax, ebx
je 0x42af17
lea ecx, [eax - 1]
mov eax, edi
call fcn.00402bbf
cmp ax, 0x5c
je 0x42af17
push 0x530c3c
mov ecx, edi
call fcn.00411f5d
add esi, 0x2034
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Programs
call fcn.0040254f
push ecx
mov byte [ebp - 4], 2
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.004022fa
push SysReAllocStringLen
mov byte [ebp - 4], bl
call fcn.0040e717
jmp 0x42afe6
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Common_Programs
call fcn.0040254f
push ecx
mov byte [ebp - 4], 3
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.004022fa
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, edi
mov byte [ebp - 4], bl
call fcn.0040e5d9
cmp eax, ebx
je 0x42afae
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
cmp eax, ebx
je 0x42afae
lea ecx, [eax - 1]
mov eax, edi
call fcn.00402bbf
cmp ax, 0x5c
je 0x42afae
push 0x530c3c
mov ecx, edi
call fcn.00411f5d
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.Programs
add esi, 0x2034
call fcn.0040254f
push ecx
mov byte [ebp - 4], 4
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.004022fa
push SysReAllocStringLen
mov ecx, esi
mov byte [ebp - 4], bl
call fcn.0040e5d9
cmp eax, ebx
je 0x42b00f
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
cmp eax, ebx
je 0x42b00f
lea ecx, [eax - 1]
mov eax, esi
call fcn.00402bbf
cmp ax, 0x5c
je 0x42b00f
push 0x530c3c
mov ecx, esi
call fcn.00411f5d
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402845
call fcn.004b6808
ret
Function at 0x4303c8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x56f710]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x58]
push eax
push 1
push 0
push dword [0x5798f8]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x430425
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push dword [0x579900]
mov dword [ebp - 0x5c], 0x50
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x430425
cmp dword [ebp - 0x54], eax
sete al
jmp 0x430427
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b228f
leave
ret
Function at 0x4308ad
Capabilities:
Check if file exists

Disassembly:
push 0x30
mov eax, 0x4d7723
call fcn.004b6730
mov edi, 0x57c3ec
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0049ce85
xor ebx, ebx
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], ebx
call fcn.0049ce85
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0049ce85
push 0xffffffffffffffff
push ebx
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.0049cf06
push dword [0x579924]
mov ecx, edi
call fcn.0045dd8b
pop ecx
call fcn.0049219b
push eax
lea ecx, [ebp - 0x10]
call fcn.00402802
push 0x12
lea esi, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00406d5c
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
je 0x43093e
push eax
call ebx
test eax, eax
je 0x43093e
mov eax, esi
push eax
push dword [0x57c3f4]
mov ecx, edi
call fcn.0049d2c3
push 0x13
lea esi, [ebp - 0x10]
call fcn.00406d5c
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x430968
push eax
call ebx
test eax, eax
je 0x430968
mov eax, esi
push eax
push dword [0x57c3f4]
mov ecx, edi
call fcn.0049d2c3
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402845
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0049d161
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0
call fcn.0049d161
mov eax, edi
call fcn.004b6808
ret
Function at 0x434ba9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1d8]
sub esp, 0x258
mov eax, dword [0x56f710]
xor eax, ebp
mov dword [ebp + 0x1d4], eax
push esi
xor esi, esi
cmp dword [0x57b924], esi
jne 0x434c78
push ebx
lea eax, [ebp - 0x78]
push eax
push 0x20019
push esi
xor ebx, ebx
push str.SoftwareMicrosoftPlus_ThemesCurrent
inc ebx
push SysReAllocStringLen
mov dword [0x57b924], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x434c77
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
push esi
push dword [ebp - 0x78]
mov dword [ebp - 0x80], 0x104
mov dword [ebp - 0x7c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x434c6e
push edi
push 0xb
pop ecx
mov esi, str.Windows_Classic.theme
lea edi, [ebp + 0x1a8]
lea eax, [ebp - 0x74]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
call esi
mov edi, eax
lea eax, [ebp + 0x1a8]
push eax
call esi
cmp edi, eax
jl 0x434c6d
lea eax, [ebp + 0x1a8]
push eax
push eax
call esi
sub edi, eax
lea eax, [ebp + edi*2 - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x434c6d
mov dword [0x57b920], ebx
pop edi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov ecx, dword [ebp + 0x1d4]
mov eax, dword [0x57b920]
xor ecx, ebp
pop esi
call fcn.004b228f
add ebp, 0x1d8
leave
ret