joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414a60
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
xor esi, esi
xor ebp, ebp
push edi
test ebx, ebx
jb 0x414ad6
ja 0x414a79
cmp esi, dword [esp + 0x20]
jae 0x414ada
mov ecx, dword [esp + 0x20]
sub ecx, esi
mov eax, ebx
sbb eax, ebp
test eax, eax
ja 0x414a95
jb 0x414a91
cmp ecx, 0x10000
jae 0x414a95
mov edi, ecx
jmp 0x414a9a
mov edi, 0x10000
mov ecx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x20]
push edi
lea edx, [esi + ecx]
push edx
push eax
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x414ad6
mov eax, dword [esp + 0x10]
cmp eax, edi
jne 0x414ad6
add esi, eax
adc ebp, 0
cmp ebp, ebx
jb 0x414a79
ja 0x414ad6
cmp esi, dword [esp + 0x20]
jb 0x414a79
cmp esi, dword [esp + 0x20]
jne 0x414af7
cmp ebp, ebx
jne 0x414af7
or esi, ebp
je 0x414aef
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret

Function at 0x415110
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x43e671
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x455d50]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
mov eax, dword [0x455d50]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x10], eax
xor ecx, ecx
push eax
mov ebx, 0x104
lea esi, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], eax
mov word [esp + 0x20], cx
call fcn.0040e600
mov dword [esp + 0x40], 1
mov eax, dword [esp + 0x1c]
mov ebp, 8
cmp dword [esp + 0x30], ebp
jae 0x415188
lea eax, [esp + 0x1c]
mov edx, dword [esp + 0x48]
push 1
push edx
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x4151ac
or eax, 0xffffffff
xor ebx, ebx
lea esi, [esp + 0x18]
call fcn.00419bb0
jmp 0x4151f4
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], ebp
jae 0x4151ba
lea eax, [esp + 0x1c]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4151c0
mov ecx, dword [esp + 0x2c]
sub eax, edx
sar eax, 1
mov ebx, eax
cmp ebx, ecx
ja 0x4151e7
or eax, 0xffffffff
lea esi, [esp + 0x18]
call fcn.00419bb0
jmp 0x4151f4
mov eax, ebx
sub eax, ecx
lea ebx, [esp + 0x18]
call fcn.00418b20
mov ecx, dword [esp + 0x1c]
cmp dword [esp + 0x30], ebp
jae 0x415202
lea ecx, [esp + 0x1c]
push edi
call fcn.00411fe0
xor ebx, ebx
mov dword [esp + 0x10], 1
mov byte [esp + 0x40], bl
cmp dword [esp + 0x30], ebp
jb 0x415229
mov eax, dword [esp + 0x1c]
push eax
call fcn.00405c1a
add esp, 4
xor ecx, ecx
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], cx
mov eax, edi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00404b64
add esp, 0x34
ret
Function at 0x415660
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43d441
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x455d50]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
push esi
push edi
mov eax, dword [0x455d50]
xor eax, esp
push eax
lea eax, [esp + 0x278]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 0x24c
lea eax, [esp + 0x24]
push 0
push eax
mov dword [esp + 0x28], 0
call fcn.0042ace0
lea ecx, [esp + 0x20]
push esi
push ecx
mov ebx, str..
call fcn.0040b740
add esp, 0x14
mov dword [esp + 0x280], 0
mov eax, dword [eax]
lea edx, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
mov dword [esp + 0x280], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.0040d9c0
cmp edi, 0xffffffff
je 0x41582e
mov ecx, 0x448b50
lea eax, [esp + 0x48]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x415736
test dx, dx
je 0x415732
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x415736
add eax, 4
add ecx, 4
test dx, dx
jne 0x415710
xor eax, eax
jmp 0x41573b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x415813
mov ecx, 0x448b54
lea eax, [esp + 0x48]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x415776
test dx, dx
je 0x415772
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x415776
add eax, 4
add ecx, 4
test dx, dx
jne 0x415750
xor eax, eax
jmp 0x41577b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x415813
lea eax, [esp + 0x18]
push esi
push eax
mov ebx, 0x448b5c
call fcn.0040b740
mov dword [esp + 0x288], 1
push eax
lea ecx, [esp + 0x1c]
push ecx
lea ebx, [esp + 0x58]
call fcn.0040b740
add esp, 0x10
mov byte [esp + 0x280], 3
lea ecx, [esp + 0x18]
call fcn.0040d9c0
test byte [esp + 0x1c], 0x10
je 0x4157e4
mov edx, dword [ebp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
call fcn.00415660
mov ecx, dword [esp + 0x18]
add esp, 8
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edx, dword [esp + 0x10]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [esp + 0x280], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.0040d9c0
lea ecx, [esp + 0x1c]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x415707
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [ebp + 0xc], 0
je 0x41583d
mov edx, dword [esi]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [esp + 0x278]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.00404b64
mov esp, ebp
pop ebp
ret
Function at 0x415861
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x4158a8
call fcn.00406bf3
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4158a8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x4158c4
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00421234
mov esi, eax
test edi, edi
je 0x4158c2
test ebx, ebx
je 0x4158c2
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4161d0
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov esi, eax
push 0
lea ecx, [esi + 0x90]
call fcn.0040bbad
add esi, 0x9fc
push 5
mov ecx, esi
call fcn.0040bbad
mov eax, dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0x19
push 0x77
push eax
call edi
mov eax, dword [esi + 0x20]
push 0
push 0
push eax
push 0x410be0
push 0
push 0
call fcn.00429bb1
mov ecx, dword [esi + 0x20]
add esp, 0x18
push 0
push 0x1388
push 0x75
push ecx
mov dword [esi + 0x74], eax
call edi
pop edi
pop esi
ret

Function at 0x416360
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x43eb79
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x455d50]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
mov dword [esp + 0x1c], 0
push 0x23
mov dword [esp + 0x14], 0
call fcn.00415110
add esp, 4
mov dword [esp + 0x1c], 0
push 0xd
push 0x448b60
push edi
mov dword [esp + 0x1c], 1
call fcn.0040d200
mov eax, dword [edi]
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4163e2
mov eax, dword [edi]
push 0
push eax
call esi
mov ecx, dword [edi]
call fcn.004190b0
push 3
push 0x449b2c
push edi
call fcn.0040d200
mov eax, dword [edi]
push eax
call ebp
test eax, eax
jne 0x416406
mov eax, dword [edi]
push 0
push eax
call esi
mov ecx, dword [edi]
call fcn.004190b0
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret
Function at 0x416650
Capabilities:
Check for time delay via gettickcount
Delete service
Query service status
Stop service

Disassembly:
push 0xffffffffffffffff
push 0x43c528
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov eax, dword [0x455d50]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov dword [esp + 0x4c], 0
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
push 0xf003f
push 0
push 0
mov dword [esp + 0x24], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [esp + 0x1c], ebx
test ebx, ebx
je 0x416795
mov eax, dword [esp + 0x54]
push 0x2c
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x416795
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
lea ecx, [esp + 0x14]
push ecx
push 0x24
lea edx, [esp + 0x28]
push edx
push 0
push esi
call edi
test eax, eax
je 0x416782
mov eax, dword [esp + 0x24]
cmp eax, 1
je 0x416795
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
cmp eax, 3
jne 0x41672e
mov eax, dword [esp + 0x38]
push eax
call ebx
lea ecx, [esp + 0x14]
push ecx
push 0x24
lea edx, [esp + 0x28]
push edx
push 0
push esi
call edi
test eax, eax
je 0x41677e
cmp dword [esp + 0x24], 1
je 0x41677e
call ebp
sub eax, dword [esp + 0x18]
cmp eax, 0x2bf20
ja 0x41677e
cmp dword [esp + 0x24], 3
je 0x4166f7
lea eax, [esp + 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x41677e
cmp dword [esp + 0x24], 1
je 0x41677e
push 0x3e8
call ebx
lea ecx, [esp + 0x14]
push ecx
push 0x24
lea edx, [esp + 0x28]
push edx
push 0
push esi
call edi
test eax, eax
je 0x41677e
cmp dword [esp + 0x24], 1
je 0x41677e
call ebp
sub eax, dword [esp + 0x18]
cmp eax, 0x2bf20
ja 0x41677e
cmp dword [esp + 0x24], 1
jne 0x416747
mov ebx, dword [esp + 0x1c]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
mov dword [esp + 0x4c], 0xffffffff
lea ecx, [esp + 0x54]
call fcn.0040d9c0
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret

Function at 0x416a50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x416a69
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x416aa4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x416aa0
lea ebx, [ebx]
cmp esi, eax
jae 0x416aa4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x416a90
cmp esi, eax
jb 0x416aaa
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x4178d0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x43ec88
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x455d50]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
call fcn.00415020
add esp, 4
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ecx
call esi
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
mov ebx, str._shm
call fcn.0040b740
add esp, 8
mov byte [esp + 0x1c], 1
mov eax, dword [eax]
push eax
call esi
mov byte [esp + 0x1c], 0
lea ecx, [esp + 0x10]
call fcn.0040d9c0
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
mov ebx, str._wal
call fcn.0040b740
add esp, 8
mov byte [esp + 0x1c], 2
mov eax, dword [eax]
push eax
call esi
mov byte [esp + 0x1c], 0
lea ecx, [esp + 0x10]
call fcn.0040d9c0
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.0040d9c0
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x418e20
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43ee69
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x455d50]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x14], ebx
test esi, esi
jne 0x418e73
lea eax, [esp + 0x18]
push eax
call fcn.004242c0
add esp, 4
mov dword [esp + 0x30], ebx
mov ebx, 1
mov dword [esp + 0x14], ebx
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
call fcn.00411fe0
mov dword [esp + 0x30], 2
test bl, 1
je 0x418e9a
and ebx, 0xfffffffe
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], ebx
call fcn.0040d9c0
mov eax, dword [ebp + 8]
test al, al
je 0x418f46
mov ecx, dword [esp + 0x10]
push ecx
push eax
call fcn.00416850
add esp, 8
test al, al
jne 0x418f51
lea edx, [esp + 0x20]
push edx
mov ecx, 0x44944c
call fcn.00411fe0
mov byte [esp + 0x30], 3
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push edx
mov ebx, eax
call fcn.00420e90
mov byte [esp + 0x38], 4
push eax
lea eax, [esp + 0x24]
push eax
mov ebx, str.___minimize
call fcn.0040b740
add esp, 0x10
mov byte [esp + 0x30], 6
lea ecx, [esp + 0x1c]
call fcn.0040d9c0
mov byte [esp + 0x30], 7
lea ecx, [esp + 0x20]
call fcn.0040d9c0
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
push 1
push 0x448bc4
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov byte [esp + 0x30], 2
lea ecx, [esp + 0x18]
call fcn.0040d9c0
jmp 0x418f79
push esi
push 0
call fcn.00416850
add esp, 8
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push 0x448bc4
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call esi
push 0x448bc4
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.0040d9c0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4193c0
Capabilities:
Start service

Disassembly:
push 0xffffffffffffffff
push 0x43be70
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebp
push esi
push edi
mov eax, dword [0x455d50]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [esp + 0x10], edi
mov dword [esp + 0x20], 0
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x41946f
mov eax, dword [esp + 0x28]
push 0x10
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [esp + 0x14], esi
mov byte [esp + 0x20], 1
test esi, esi
je 0x419463
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x419463
mov byte [esp + 0x20], 0
push esi
mov esi, ebp
call esi
mov dword [esp + 0x20], 0xffffffff
push edi
call esi
mov al, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret
mov byte [esp + 0x20], 0
test esi, esi
je 0x41946f
push esi
call ebp
mov dword [esp + 0x20], 0xffffffff
test edi, edi
je 0x41947e
push edi
call ebp
xor al, al
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret

Function at 0x4195b0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebx
xor ebx, ebx
push ebp
push edi
cmp dword [esi + 0x34], ebx
ja 0x4195c4
cmp dword [esi + 0x30], 0x40
jbe 0x4196c8
mov edi, dword [esi + 0x28]
mov ebp, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 0x40
push edi
call ebp
test eax, eax
jne 0x4196cd
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x4196cd
mov byte [esi + 0x38], 1
mov eax, dword [edi + 0x3c]
mov edi, dword [esi + 0x34]
xor ecx, ecx
lea edx, [eax + 0xf8]
cmp edi, ecx
jb 0x4196c8
ja 0x41960f
mov ecx, dword [esi + 0x30]
cmp ecx, edx
jbe 0x4196c8
mov edx, dword [esi + 0x28]
add eax, edx
push 0xf8
push eax
mov dword [esi + 0x24], eax
call ebp
test eax, eax
jne 0x4196cd
mov eax, dword [esi + 0x24]
cmp dword [eax], 0x4550
jne 0x4196cd
mov ecx, 0x2000
test word [eax + 0x16], cx
jne 0x419645
mov byte [esi + 0x44], 1
mov edx, eax
movzx eax, word [edx + 0x18]
mov ecx, 0x10b
cmp ax, cx
jne 0x419661
mov dword [esi + 0x40], 1
add edx, 0x78
jmp 0x419678
mov ecx, 0x20b
cmp ax, cx
jne 0x41967b
mov dword [esi + 0x40], 2
add edx, 0x88
mov dword [esi + 0x20], edx
cmp dword [esi + 0x20], ebx
je 0x4196cd
mov eax, dword [esi + 0x24]
movzx ecx, word [eax + 6]
mov dword [esi + 0x3c], ecx
test ecx, ecx
je 0x4196cd
movzx edx, word [eax + 0x14]
mov ebx, dword [esi + 0x34]
lea ecx, [ecx + ecx*4]
add ecx, ecx
add ecx, ecx
add ecx, ecx
sub ecx, dword [esi + 0x28]
add ecx, edx
lea edi, [ecx + eax + 0x18]
xor ecx, ecx
cmp ebx, ecx
jb 0x4196c8
ja 0x4196b6
mov ecx, dword [esi + 0x30]
cmp ecx, edi
jbe 0x4196c8
pop edi
mov ebx, 1
lea edx, [edx + eax + 0x18]
pop ebp
mov eax, ebx
mov dword [esi + 0x1c], edx
pop ebx
ret
mov ebx, 2
pop edi
pop ebp
mov eax, ebx
pop ebx
ret
Function at 0x420770
Capabilities:
Accept command line arguments
Delete registry key

Disassembly:
push 0xffffffffffffffff
push 0x43efe0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x455d50]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
push 0
mov ecx, 0x45a408
mov dword [esp + 0x1c], 0x45a408
call fcn.00401741
mov dword [esp + 0x24], 0
push 0x420660
mov dword [0x45a408], 0x44a584
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call fcn.00406ca0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0xc]
push ecx
mov ecx, eax
call fcn.00411fe0
mov byte [esp + 0x24], 1
push 0x67
lea edx, [esp + 0x14]
push edx
call fcn.00409db0
mov byte [esp + 0x24], 2
mov eax, dword [eax]
test eax, eax
jne 0x4207fe
or eax, 0xffffffff
jmp 0x420826
mov ecx, dword [esp + 0xc]
cmp dword [ecx - 0xc], 0
jge 0x42080d
or eax, 0xffffffff
jmp 0x420826
push eax
push ecx
call fcn.0042a5b3
add esp, 8
test eax, eax
jne 0x420820
or eax, 0xffffffff
jmp 0x420826
sub eax, dword [esp + 0xc]
sar eax, 1
cmp eax, 0xffffffff
setne bl
mov byte [esp + 0x24], 1
lea ecx, [esp + 0x10]
call fcn.0040d9c0
test bl, bl
je 0x420845
mov byte [0x45a376], 1
push 0x69
lea eax, [esp + 0x14]
push eax
call fcn.00409db0
mov byte [esp + 0x24], 3
mov eax, dword [eax]
test eax, eax
jne 0x420861
or eax, 0xffffffff
jmp 0x420889
mov ecx, dword [esp + 0xc]
cmp dword [ecx - 0xc], 0
jge 0x420870
or eax, 0xffffffff
jmp 0x420889
push eax
push ecx
call fcn.0042a5b3
add esp, 8
test eax, eax
jne 0x420883
or eax, 0xffffffff
jmp 0x420889
sub eax, dword [esp + 0xc]
sar eax, 1
cmp eax, 0xffffffff
setne bl
mov byte [esp + 0x24], 1
lea ecx, [esp + 0x10]
call fcn.0040d9c0
test bl, bl
je 0x4208a8
mov byte [0x45a377], 1
cmp byte [0x45a376], 0
je 0x420976
call fcn.0041b2d0
test al, al
je 0x4208c8
push 1
call fcn.00408000
add esp, 4
lea ecx, [esp + 0x10]
push ecx
call fcn.0040cfb0
add esp, 4
mov bl, 4
mov byte [esp + 0x24], bl
mov esi, dword [esp + 0x10]
cmp dword [esi - 0xc], 0
je 0x4208ea
call fcn.0040a690
push 0x6a
lea edx, [esp + 0x18]
push edx
call fcn.00409db0
mov byte [esp + 0x24], 5
mov eax, dword [eax]
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push eax
push SysReAllocString
call esi
mov byte [esp + 0x24], bl
lea ecx, [esp + 0x14]
call fcn.0040d9c0
push 0x6b
lea eax, [esp + 0x18]
push eax
call fcn.00409db0
mov byte [esp + 0x24], 6
mov eax, dword [eax]
push eax
push SysReAllocString
call esi
mov byte [esp + 0x24], bl
lea ecx, [esp + 0x14]
call fcn.0040d9c0
push 0x6c
lea ecx, [esp + 0x18]
push ecx
call fcn.00409db0
mov byte [esp + 0x24], 7
mov eax, dword [eax]
push eax
push SysReAllocString
call esi
mov byte [esp + 0x24], bl
lea ecx, [esp + 0x14]
call fcn.0040d9c0
mov byte [esp + 0x24], 1
lea ecx, [esp + 0x10]
call fcn.0040d9c0
mov eax, 0x409
mov dword [0x457354], eax
mov dword [0x457358], eax
mov byte [esp + 0x24], 0
lea ecx, [esp + 0xc]
call fcn.0040d9c0
mov dword [esp + 0x24], 0xffffffff
mov eax, 0x45a408
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x421be0
Capabilities:
Create shortcut via ishelllink

Disassembly:
push 0xffffffffffffffff
push 0x43c570
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x455d50]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 0x14], 3
lea eax, [esp + 4]
push eax
push 0x448414
push 1
push 0
push 0x448424
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x421cc7
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x50]
call eax
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x3c]
push 1
push eax
call edx
mov eax, dword [esp + 0x24]
cmp dword [eax - 0xc], 0
je 0x421c74
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
push 0
push eax
mov eax, dword [edx + 0x44]
push ecx
call eax
mov eax, dword [esp + 0x28]
cmp dword [eax - 0xc], 0
je 0x421c8b
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x2c]
push ecx
call eax
mov eax, dword [esp + 4]
mov ecx, dword [eax]
lea edx, [esp + 8]
push edx
push 0x448434
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jl 0x421cc7
mov eax, dword [esp + 8]
test eax, eax
je 0x421cc7
mov edx, dword [esp + 0x20]
mov ecx, dword [eax]
push 1
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x14], 2
lea ecx, [esp + 0x1c]
call fcn.0040d9c0
mov byte [esp + 0x14], 1
lea ecx, [esp + 0x20]
call fcn.0040d9c0
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x24]
call fcn.0040d9c0
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esp + 0x28]
call fcn.0040d9c0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
add esp, 0x14
ret