joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a270
Capabilities:
Delete registry value
Persist via default file association registry key
Set registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
mov dword [esp], 0
push eax
push 2
push 0
push str.cmdfile_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42a29f
or eax, 0xffffffff
add esp, 0x10
ret
mov cl, 0x22
push esi
mov byte [esp + 8], cl
mov byte [esp + 0xb], cl
lea ecx, [esp + 8]
push edi
mov al, 0x25
push ecx
mov byte [esp + 0x11], al
mov byte [esp + 0x12], 0x31
mov byte [esp + 0x14], 0x20
mov byte [esp + 0x15], al
mov byte [esp + 0x16], 0x2a
mov byte [esp + 0x17], 0
call fcn.00483565
mov edx, dword [esp + 0xc]
add esp, 4
mov esi, eax
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push esi
push 1
push eax
push eax
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
add esp, 0x10
ret

Function at 0x42a320
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
mov dword [esp], 0
push eax
push 2
push 0
push str.batfile_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42a34f
or eax, 0xffffffff
add esp, 0x10
ret
mov cl, 0x22
push edi
mov byte [esp + 8], cl
mov byte [esp + 0xb], cl
lea ecx, [esp + 8]
mov al, 0x25
push ecx
mov byte [esp + 0xd], al
mov byte [esp + 0xe], 0x31
mov byte [esp + 0x10], 0x20
mov byte [esp + 0x11], al
mov byte [esp + 0x12], 0x2a
mov byte [esp + 0x13], 0
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0xc]
push 1
push eax
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
add esp, 0x10
ret

Function at 0x42a3c0
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
mov dword [esp], 0
push eax
push 2
push 0
push str.comfile_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42a3ef
or eax, 0xffffffff
add esp, 0x10
ret
mov cl, 0x22
push edi
mov byte [esp + 8], cl
mov byte [esp + 0xb], cl
lea ecx, [esp + 8]
mov al, 0x25
push ecx
mov byte [esp + 0xd], al
mov byte [esp + 0xe], 0x31
mov byte [esp + 0x10], 0x20
mov byte [esp + 0x11], al
mov byte [esp + 0x12], 0x2a
mov byte [esp + 0x13], 0
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0xc]
push 1
push eax
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
add esp, 0x10
ret
Function at 0x42a460
Capabilities:
Delete registry value
Get common file path
Persist via default file association registry key
Set registry value

Disassembly:
sub esp, 0x20c
lea eax, [esp]
mov dword [esp], 0
push eax
push 2
push 0
push str.regfile_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42a495
or eax, 0xffffffff
add esp, 0x20c
ret
push esi
push edi
lea ecx, [esp + 0x14]
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov al, 0x22
lea edx, [esp + 0xc]
mov byte [esp + 0xc], al
mov byte [esp + 0xf], al
lea eax, [esp + 0x14]
push edx
push eax
lea ecx, [esp + 0x11c]
push str._s_regedit.exe__s
push ecx
mov byte [esp + 0x1d], 0x25
mov byte [esp + 0x1e], 0x31
mov byte [esp + 0x20], 0
call fcn.0047a8f8
lea edx, [esp + 0x124]
push edx
call fcn.00483565
add esp, 0x14
mov esi, eax
mov eax, dword [esp + 8]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0xc]
push esi
push 1
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
add esp, 0x20c
ret

Function at 0x42a530
Capabilities:
Delete registry value
Get common file path
Persist via default file association registry key
Set registry value

Disassembly:
sub esp, 0x20c
lea eax, [esp]
mov dword [esp], 0
push eax
push 2
push 0
push str.regedit_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42a565
or eax, 0xffffffff
add esp, 0x20c
ret
push esi
push edi
lea ecx, [esp + 0x114]
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov al, 0x22
lea edx, [esp + 0xc]
mov byte [esp + 0xc], al
mov byte [esp + 0xf], al
lea eax, [esp + 0x114]
push edx
push eax
lea ecx, [esp + 0x1c]
push str._s_regedit.exe__s
push ecx
mov byte [esp + 0x1d], 0x25
mov byte [esp + 0x1e], 0x31
mov byte [esp + 0x20], 0
call fcn.0047a8f8
lea edx, [esp + 0x24]
push edx
call fcn.00483565
lea eax, [esp + 0x28]
push eax
call fcn.00483565
mov ecx, dword [esp + 0x20]
add esp, 0x18
mov esi, eax
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 8]
repne scasb al, byte es:[edi]
not ecx
push ecx
push esi
push 1
push eax
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
add esp, 0x20c
ret
Function at 0x42a610
Capabilities:
Delete registry value
Persist via default file association registry key
Set registry value

Disassembly:
sub esp, 0x104
lea eax, [esp]
mov dword [esp], 0
push eax
push 2
push 0
push str.helpfile_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42a645
or eax, 0xffffffff
add esp, 0x104
ret
push esi
push edi
push 0x49bccc
lea ecx, [esp + 0x10]
push str.winhlp32.exe__s
push ecx
call fcn.0047a8f8
lea edx, [esp + 0x18]
push edx
call fcn.00483565
add esp, 0x10
mov esi, eax
mov eax, dword [esp + 8]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0xc]
push esi
push 1
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
add esp, 0x104
ret

Function at 0x42a6b0
Capabilities:
Delete registry value
Get common file path
Persist via default file association registry key
Set registry value

Disassembly:
sub esp, 0x204
lea eax, [esp]
mov dword [esp], 0
push eax
push 2
push 0
push str.Drive_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42a6e5
or eax, 0xffffffff
add esp, 0x204
ret
push esi
push edi
lea ecx, [esp + 0xc]
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0xc]
lea eax, [esp + 0x10c]
push edx
push str._sexplorer.exe
push eax
call fcn.0047a8f8
lea ecx, [esp + 0x118]
push ecx
call fcn.00483565
mov edx, dword [esp + 0x18]
add esp, 0x10
mov esi, eax
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push esi
push 1
push eax
push eax
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
add esp, 0x204
ret
Function at 0x42a770
Capabilities:
Delete registry value
Get common file path
Persist via default file association registry key
Set registry value

Disassembly:
sub esp, 0x204
lea eax, [esp]
mov dword [esp], 0
push eax
push 2
push 0
push str.wrifile_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42a7a5
or eax, 0xffffffff
add esp, 0x204
ret
push esi
push edi
lea ecx, [esp + 0xc]
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x49bccc
lea edx, [esp + 0x10]
push str.Program_FilesWindows_NTAccessoriesWORDPAD.EXE
push edx
lea eax, [esp + 0x118]
push str._s_s__s
push eax
mov byte [esp + 0x23], 0
call fcn.0047a8f8
lea ecx, [esp + 0x120]
push ecx
call fcn.00483565
lea edx, [esp + 0x124]
push edx
call fcn.00483565
add esp, 0x1c
mov esi, eax
mov eax, dword [esp + 8]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0xc]
push esi
push 1
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
add esp, 0x204
ret

Function at 0x42a840
Capabilities:
Get common file path
Persist via default file association registry key
Set registry value

Disassembly:
sub esp, 0x304
lea eax, [esp]
mov dword [esp], 0
push eax
push 2
push 0
push str.txtfile_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42a875
or eax, 0xffffffff
add esp, 0x304
ret
push edi
lea ecx, [esp + 0x208]
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x108]
push 0x100
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x108]
push 0x49bccc
push eax
lea ecx, [esp + 0x10]
push str._s_notepad.exe__s
push ecx
call fcn.0047a8f8
lea edx, [esp + 0x18]
push edx
call fcn.00483565
lea eax, [esp + 0x1c]
push eax
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 8]
push edx
push 1
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
add esp, 0x304
ret
Function at 0x42a910
Capabilities:
Get common file path
Persist via default file association registry key
Set registry value

Disassembly:
sub esp, 0x304
lea eax, [esp]
mov dword [esp], 0
push eax
push 2
push 0
push str.inifile_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42a945
or eax, 0xffffffff
add esp, 0x304
ret
push edi
lea ecx, [esp + 0x208]
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x108]
push 0x100
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x108]
push 0x49bccc
push eax
lea ecx, [esp + 0x10]
push str._s_notepad.exe__s
push ecx
call fcn.0047a8f8
lea edx, [esp + 0x18]
push edx
call fcn.00483565
lea eax, [esp + 0x1c]
push eax
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 8]
push edx
push 1
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
add esp, 0x304
ret
Function at 0x42a9e0
Capabilities:
Delete registry value
Get common file path
Persist via default file association registry key
Set registry value

Disassembly:
sub esp, 0x210
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push 2
push 0
push str.cplfile_shellcplopencommand
push closesocket
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42aa1d
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x210
ret
lea ecx, [esp + 0x120]
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov al, 0x25
lea edx, [esp + 0x14]
mov byte [esp + 0x15], al
mov byte [esp + 0x19], al
push edx
lea eax, [esp + 0x24]
mov cl, 0x22
push str.rundll32.exe_shell32.dll_Control_RunDLL__s
push eax
mov byte [esp + 0x20], cl
mov byte [esp + 0x22], 0x31
mov byte [esp + 0x23], cl
mov byte [esp + 0x24], 0x20
mov byte [esp + 0x26], 0x2a
mov byte [esp + 0x27], 0
call fcn.0047a8f8
lea ecx, [esp + 0x2c]
push ecx
call fcn.00483565
mov edx, dword [esp + 0x20]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
add esp, 0x10
mov esi, eax
push 0
push edx
call ebp
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
repne scasb al, byte es:[edi]
not ecx
push ecx
push esi
push 1
push eax
push eax
mov eax, dword [esp + 0x24]
push eax
call ebx
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x10]
push edx
push 2
push 0
push str.cplfile_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42aade
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x210
ret
mov eax, dword [esp + 0x10]
push 0
push eax
call ebp
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push esi
push 1
push eax
push eax
push ecx
call ebx
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x210
ret
Function at 0x42ab20
Capabilities:
Delete registry value
Get common file path
Persist via default file association registry key
Set registry value

Disassembly:
sub esp, 0x210
lea eax, [esp]
mov dword [esp], 0
push eax
push 2
push 0
push str.htafile_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42ab55
or eax, 0xffffffff
add esp, 0x210
ret
push esi
push edi
lea ecx, [esp + 0x18]
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov al, 0x25
mov cl, 0x22
mov byte [esp + 0xd], al
mov byte [esp + 0x11], al
lea edx, [esp + 0xc]
lea eax, [esp + 0x18]
mov byte [esp + 0xc], cl
mov byte [esp + 0xf], cl
push edx
push eax
lea ecx, [esp + 0x120]
push str._smshta.exe__s
push ecx
mov byte [esp + 0x1e], 0x31
mov byte [esp + 0x20], 0x20
mov byte [esp + 0x22], 0x2a
mov byte [esp + 0x23], 0
call fcn.0047a8f8
lea edx, [esp + 0x128]
push edx
call fcn.00483565
add esp, 0x14
mov esi, eax
mov eax, dword [esp + 8]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0xc]
push esi
push 1
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
add esp, 0x210
ret

Function at 0x42ac00
Capabilities:
Get common file path
Persist via default file association registry key
Set registry value

Disassembly:
sub esp, 0x310
lea eax, [esp]
mov dword [esp], 0
push eax
push 2
push 0
push str.rtffile_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42ac35
or eax, 0xffffffff
add esp, 0x310
ret
push edi
lea ecx, [esp + 0x214]
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x14]
push 0x100
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov al, 0x22
lea ecx, [esp + 0x14]
mov byte [esp + 8], al
mov byte [esp + 0xb], al
lea eax, [esp + 8]
lea edx, [esp + 0x114]
push eax
push ecx
push str._sProgram_FilesWindows_NTAccessoriesWORDPAD.EXE__s
push edx
mov byte [esp + 0x26], 0
mov byte [esp + 0x19], 0x25
mov byte [esp + 0x1a], 0x31
mov byte [esp + 0x1c], 0
call fcn.0047a8f8
lea eax, [esp + 0x124]
push eax
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 8]
push edx
push 1
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
add esp, 0x310
ret
Function at 0x42ace0
Capabilities:
Get common file path
Persist via default file association registry key
Set registry value

Disassembly:
sub esp, 0x304
lea eax, [esp]
mov dword [esp], 0
push eax
push 2
push 0
push str.inffile_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42ad15
or eax, 0xffffffff
add esp, 0x304
ret
push edi
lea ecx, [esp + 0x208]
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x108]
push 0x100
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x108]
push 0x49bccc
push eax
lea ecx, [esp + 0x10]
push str._s_notepad.exe__s
push ecx
call fcn.0047a8f8
lea edx, [esp + 0x18]
push edx
call fcn.00483565
lea eax, [esp + 0x1c]
push eax
call fcn.00483565
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 8]
push edx
push 1
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
add esp, 0x304
ret

Function at 0x42adb0
Capabilities:
Delete registry value
Get common file path
Persist via default file association registry key
Set registry value

Disassembly:
sub esp, 0x204
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push 2
push 0
push str.htmlfile_shellopencommand
push closesocket
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42aded
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x204
ret
lea ecx, [esp + 0x14]
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x14]
lea eax, [esp + 0x114]
push edx
push str._sProgram_FilesInternet_Exploreriexplore.exe
push eax
mov byte [esp + 0x22], 0
call fcn.0047a8f8
lea ecx, [esp + 0x120]
push ecx
call fcn.00483565
mov edx, dword [esp + 0x20]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
add esp, 0x10
mov esi, eax
push 0
push edx
call ebp
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
repne scasb al, byte es:[edi]
not ecx
push ecx
push esi
push 1
push eax
push eax
mov eax, dword [esp + 0x24]
push eax
call ebx
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x10]
mov dword [esp + 0x10], 0
push edx
push 2
push 0
push str.htmlfile_shellopennewcommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42ae96
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x204
ret
mov eax, dword [esp + 0x10]
push 0
push eax
call ebp
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push esi
push 1
push eax
push eax
push ecx
call ebx
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x204
ret
Function at 0x42aee0
Capabilities:
Delete registry value
Get common file path
Persist via default file association registry key
Set registry value

Disassembly:
sub esp, 0x204
lea eax, [esp]
mov dword [esp], 0
push eax
push 2
push 0
push str.http_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42af15
or eax, 0xffffffff
add esp, 0x204
ret
push esi
push edi
lea ecx, [esp + 0xc]
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0xc]
lea eax, [esp + 0x10c]
push edx
push str._sProgram_FilesInternet_Exploreriexplore.exe
push eax
mov byte [esp + 0x1a], 0
call fcn.0047a8f8
lea ecx, [esp + 0x118]
push ecx
call fcn.00483565
mov edx, dword [esp + 0x18]
add esp, 0x10
mov esi, eax
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push esi
push 1
push eax
push eax
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
add esp, 0x204
ret

Function at 0x42afa0
Capabilities:
Delete registry value
Get common file path
Persist via default file association registry key
Set registry value

Disassembly:
sub esp, 0x204
lea eax, [esp]
mov dword [esp], 0
push eax
push 2
push 0
push str.ftp_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42afd5
or eax, 0xffffffff
add esp, 0x204
ret
push esi
push edi
lea ecx, [esp + 0xc]
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0xc]
lea eax, [esp + 0x10c]
push edx
push str._sProgram_FilesInternet_Exploreriexplore.exe__1
push eax
mov byte [esp + 0x1a], 0
call fcn.0047a8f8
lea ecx, [esp + 0x118]
push ecx
call fcn.00483565
mov edx, dword [esp + 0x18]
add esp, 0x10
mov esi, eax
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push esi
push 1
push eax
push eax
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
add esp, 0x204
ret
Function at 0x42b060
Capabilities:
Delete registry value
Get common file path
Persist via default file association registry key
Set registry value

Disassembly:
sub esp, 0x204
lea eax, [esp]
mov dword [esp], 0
push eax
push 2
push 0
push str.Applicationsiexplore.exe_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42b095
or eax, 0xffffffff
add esp, 0x204
ret
push esi
push edi
lea ecx, [esp + 0xc]
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0xc]
lea eax, [esp + 0x10c]
push edx
push str._sProgram_FilesInternet_Exploreriexplore.exe__1
push eax
mov byte [esp + 0x1a], 0
call fcn.0047a8f8
lea ecx, [esp + 0x118]
push ecx
call fcn.00483565
mov edx, dword [esp + 0x18]
add esp, 0x10
mov esi, eax
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push esi
push 1
push eax
push eax
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
add esp, 0x204
ret

Function at 0x42b120
Capabilities:
Delete registry value
Get common file path
Persist via default file association registry key
Set registry value

Disassembly:
sub esp, 0x204
lea eax, [esp]
mov dword [esp], 0
push eax
push 2
push 0
push str.Applicationsexplorer.exe_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42b155
or eax, 0xffffffff
add esp, 0x204
ret
push esi
push edi
lea ecx, [esp + 0xc]
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0xc]
lea eax, [esp + 0x10c]
push edx
push str._sexplorer.exe
push eax
call fcn.0047a8f8
lea ecx, [esp + 0x118]
push ecx
call fcn.00483565
mov edx, dword [esp + 0x18]
add esp, 0x10
mov esi, eax
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push esi
push 1
push eax
push eax
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
add esp, 0x204
ret