joyce8/EMBER2024-capa huggingface dataset:
Function at 0x498780
Capabilities:
Read .ini file

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x498835
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x5b9260
push 1
push str.Orient
push 0x5a11dc
call edi
push 0x5b9260
push 9
push str.Size
push 0x5a11dc
mov word [esi + 0x4c], ax
call edi
push 0x5b9260
push 7
push 0x5a1288
push 0x5a11dc
mov word [esi + 0x4e], ax
call edi
push 0x5b9260
push 2
push 0x59ee40
push 0x5a11dc
mov word [esi + 0x58], ax
call edi
push 0x5b9260
push 1
push str.Duplex
push 0x5a11dc
mov word [esi + 0x5c], ax
call edi
mov word [esi + 0x5e], ax
push 0x5b9260
lea eax, [esi + 0x66]
push 0x40
push eax
push 0x5a1260
push str.SizeTxt
push 0x5a11dc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov word [esi + 0x56], 1
mov dword [esi + 0x48], 0x13b03
pop edi
pop esi
ret

Function at 0x498a00
Capabilities:
Get common file path

Disassembly:
sub esp, 0x288
lea eax, [esp]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [esp]
push ecx
call fcn.004d6713
add esp, 4
cmp word [esp + eax*2 - 2], 0x5c
je 0x498a3d
lea edx, [esp]
push 0x598458
push edx
call fcn.004d62f1
add esp, 8
lea eax, [esp]
push str.winspool.drv
push eax
call fcn.004d62f1
add esp, 8
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
add esp, 0x288
ret

Function at 0x499400
Capabilities:
Get common file path

Disassembly:
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
lea eax, [esp + 8]
push eax
push ecx
mov word [esi], 0
mov word [esi + 2], 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x499473
mov edx, dword [esp + 8]
push esi
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov eax, dword [esp + 8]
test eax, eax
je 0x499463
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push esi
call fcn.004c9990
add esp, 4
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x499cd0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
lea eax, [esp + 8]
push esi
push str.SYSTEMCurrentControlSetControlStillImageEventsSTIProxyEvent3A4D12E6_49E1_44DD_A6D0_306CFC283790
push eax
call fcn.004d631b
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 8
lea ecx, [esp + 4]
lea edx, [esp + 0xc]
push ecx
push 1
push 0
push edx
push 0x80000002
call esi
test eax, eax
je 0x499d7c
lea eax, [esp + 0xc]
push str.SOFTWAREMicrosoftWindowsCurrentVersionStillImageRegistered_Applications
push eax
call fcn.004d631b
add esp, 8
lea ecx, [esp + 4]
lea edx, [esp + 0xc]
push ecx
push 1
push 0
push edx
push 0x80000002
call esi
test eax, eax
je 0x499d3d
xor eax, eax
pop esi
add esp, 0x210
ret
mov ecx, dword [esp + 4]
push 0
lea eax, [esp + 0xc]
push 0
push eax
push 0
push 0x5b96a0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x499d71
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
add esp, 0x210
ret
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
add esp, 0x210
ret
Function at 0x49a480
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x5e4
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
test eax, eax
je 0x49a571
mov esi, dword [esp + 0x14]
push ebp
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, dword [esp + 0x1c]
push esi
push str.__s_____1___thumbs
push ebx
call fcn.004d5ee1
mov edi, dword [esp + 0x2c]
mov ecx, dword [0x5b5574]
add esp, 0xc
push 0x40
push edi
push 0x509
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
push edi
push str.SOFTWAREClassesDirectory_shell_s
push esi
call fcn.004d5ee1
push edi
call fcn.004d6713
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueW]
add esp, 0x10
add eax, eax
push eax
push edi
push 1
push esi
push 0x80000002
call ebp
push edi
push str.SOFTWAREClassesDirectory_shell_scommand
push esi
call fcn.004d5ee1
push ebx
call fcn.004d6713
add esp, 0x10
add eax, eax
push eax
push ebx
push 1
push esi
push 0x80000002
call ebp
push edi
push str.SOFTWAREClassesDrive_shell_s
push esi
call fcn.004d5ee1
push edi
call fcn.004d6713
add esp, 0x10
add eax, eax
push eax
push edi
push 1
push esi
push 0x80000002
call ebp
push edi
push str.SOFTWAREClassesDrive_shell_scommand
push esi
call fcn.004d5ee1
push ebx
call fcn.004d6713
add esp, 0x10
add eax, eax
push eax
push ebx
push 1
push esi
push 0x80000002
call ebp
pop ebp
pop edi
pop esi
pop ebx
ret
mov edi, dword [esp + 0x1c]
mov edx, dword [0x5b5574]
push 0x40
push edi
push 0x509
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
mov esi, dword [esp + 0x18]
push edi
push str.SOFTWAREClassesDirectory_shell_scommand
push esi
call fcn.004d5ee1
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add esp, 0xc
push esi
push 0x80000002
call ebx
push edi
push str.SOFTWAREClassesDirectory_shell_s
push esi
call fcn.004d5ee1
add esp, 0xc
push esi
push 0x80000002
call ebx
push edi
push str.SOFTWAREClassesDrive_shell_scommand
push esi
call fcn.004d5ee1
add esp, 0xc
push esi
push 0x80000002
call ebx
push edi
push str.SOFTWAREClassesDrive_shell_s
push esi
call fcn.004d5ee1
add esp, 0xc
push esi
push 0x80000002
call ebx
pop edi
pop esi
pop ebx
ret
Function at 0x49a600
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x5e5
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
test eax, eax
je 0x49a6ab
mov esi, dword [esp + 0x14]
push ebp
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, dword [esp + 0x1c]
push esi
push str.__s_____1_
push ebx
call fcn.004d5ee1
mov edi, dword [esp + 0x2c]
mov ecx, dword [0x5b5574]
add esp, 0xc
push 0x40
push edi
push 0x508
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
push edi
push str.SOFTWAREClasses_shell_s_
push esi
call fcn.004d5ee1
push edi
call fcn.004d6713
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueW]
add esp, 0x10
add eax, eax
push eax
push edi
push 1
push esi
push 0x80000002
call ebp
push edi
push str.SOFTWAREClasses_shell_scommand
push esi
call fcn.004d5ee1
push ebx
call fcn.004d6713
add esp, 0x10
add eax, eax
push eax
push ebx
push 1
push esi
push 0x80000002
call ebp
pop ebp
pop edi
pop esi
pop ebx
ret
mov edi, dword [esp + 0x1c]
mov edx, dword [0x5b5574]
push 0x40
push edi
push 0x508
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
mov esi, dword [esp + 0x18]
push edi
push str.SOFTWAREClasses_shell_scommand
push esi
call fcn.004d5ee1
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add esp, 0xc
push esi
push 0x80000002
call ebx
push edi
push str.SOFTWAREClasses_shell_s
push esi
call fcn.004d5ee1
add esp, 0xc
push esi
push 0x80000002
call ebx
pop edi
pop esi
pop ebx
ret
Function at 0x49a700
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x420
mov ecx, dword [esp + 0x428]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor eax, eax
push esi
mov esi, dword [esp + 0x430]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp ecx, eax
mov dword [esp + 0x18], eax
mov word [esp + 0x228], ax
je 0x49a7d1
push esi
lea eax, [esp + 0x24]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts._s
push eax
call fcn.004d5ee1
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
push 1
push 0
push edx
push 0x80000001
call ebp
test eax, eax
jne 0x49a7d1
lea eax, [esp + 0x14]
lea ecx, [esp + 0x228]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x20]
push ecx
push edx
push 0
push str.ProgID
push eax
mov dword [esp + 0x2c], 0x104
call edi
mov ecx, dword [esp + 0x10]
push ecx
call ebx
push esi
push 0x5b96a0
lea edx, [esp + 0x28]
push str._s._s
push edx
call fcn.004d5ee1
lea eax, [esp + 0x238]
lea ecx, [esp + 0x30]
push eax
push ecx
call fcn.004d7652
add esp, 0x18
test eax, eax
jne 0x49a7d1
mov dword [esp + 0x18], 1
mov eax, dword [esp + 0x43c]
test eax, eax
je 0x49a8c7
push esi
lea edx, [esp + 0x24]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts._sUserChoice
push edx
call fcn.004d5ee1
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
push 1
push 0
push ecx
push 0x80000001
call ebp
test eax, eax
jne 0x49a8c7
lea edx, [esp + 0x14]
lea eax, [esp + 0x228]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
push ecx
push 0
push str.Progid
push edx
mov dword [esp + 0x2c], 0x104
call edi
mov eax, dword [esp + 0x10]
push eax
call ebx
lea ecx, [esp + 0x228]
push ecx
call fcn.004d6713
add esp, 4
test eax, eax
jbe 0x49a8c7
push esi
push 0x5b96a0
lea edx, [esp + 0x28]
push str._s._s
push edx
call fcn.004d5ee1
lea eax, [esp + 0x238]
lea ecx, [esp + 0x30]
push eax
push ecx
call fcn.004d7652
add esp, 0x18
test eax, eax
jne 0x49a891
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x420
ret
lea edx, [esp + 0x228]
push edx
call fcn.004d78fa
lea eax, [esp + 0x22c]
push 0x5a1f68
push eax
call fcn.004d6acd
add esp, 0xc
test eax, eax
je 0x49a8c7
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x420
ret
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x49a971
mov ecx, dword [esp + 0x43c]
test ecx, ecx
jne 0x49a971
push esi
lea ecx, [esp + 0x24]
push str.SOFTWAREClasses._s
push ecx
call fcn.004d5ee1
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x20]
push edx
push 1
push 0
push eax
push 0x80000002
call ebp
test eax, eax
jne 0x49a96d
lea ecx, [esp + 0x14]
lea edx, [esp + 0x228]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push edx
push eax
push 0
push 0
push ecx
mov dword [esp + 0x2c], 0x104
call edi
mov edx, dword [esp + 0x10]
push edx
call ebx
push esi
push 0x5b96a0
lea eax, [esp + 0x28]
push str._s._s
push eax
call fcn.004d5ee1
lea ecx, [esp + 0x238]
lea edx, [esp + 0x30]
push ecx
push edx
call fcn.004d7652
add esp, 0x18
test eax, eax
mov eax, 1
je 0x49a971
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x420
ret
Function at 0x49a980
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
sub esp, 0x618
lea eax, [esp]
push ebx
push esi
push edi
mov edi, dword [esp + 0x628]
push edi
push 0x5b96a0
push str.SOFTWAREClasses_s._s
push eax
call fcn.004d5ee1
push edi
call fcn.004d722b
push eax
push 0x5b96a0
lea ecx, [esp + 0x438]
push str._s__s_File
push ecx
call fcn.004d5ee1
lea edx, [esp + 0x440]
push edx
call fcn.004d6713
add esp, 0x28
add eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueW]
lea ecx, [esp + 0xc]
push eax
lea eax, [esp + 0x420]
push eax
push 1
push ecx
push 0x80000002
call esi
lea edx, [esp + 0xc]
push str._shellopencommand
push edx
call fcn.004d62f1
mov ebx, dword [esp + 0x634]
push ebx
call fcn.004d6713
add esp, 0xc
add eax, eax
push eax
push ebx
lea eax, [esp + 0x14]
push 1
push eax
push 0x80000002
call esi
mov eax, dword [esp + 0x630]
test eax, eax
je 0x49aa3d
mov eax, dword [esp + 0x638]
test eax, eax
jne 0x49aadc
push edi
push 0x5b96a0
lea ecx, [esp + 0x14]
push str.SOFTWAREClasses_s._sDefaultIcon
push ecx
call fcn.004d5ee1
mov edi, dword [esp + 0x644]
push edi
call fcn.004d6713
add esp, 0x14
cmp eax, 1
jbe 0x49aa8c
push edi
call fcn.004d6713
add esp, 4
add eax, eax
lea edx, [esp + 0xc]
push eax
push edi
push 1
push edx
push 0x80000002
call esi
pop edi
pop esi
pop ebx
add esp, 0x618
ret
lea eax, [esp + 0x214]
push 0x102
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x214]
push 0x5a20c0
push ecx
call fcn.004d62f1
lea edx, [esp + 0x21c]
push edx
call fcn.004d6713
add esp, 0xc
add eax, eax
lea ecx, [esp + 0xc]
push eax
lea eax, [esp + 0x218]
push eax
push 1
push ecx
push 0x80000002
call esi
pop edi
pop esi
pop ebx
add esp, 0x618
ret

Function at 0x49aaf0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x414
lea eax, [esp + 4]
push str.SOFTWAREIrfanViewCapabilitiesFileAssociations
push eax
call fcn.004d5ee1
add esp, 8
lea ecx, [esp]
lea edx, [esp + 4]
push ecx
push 2
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49ab94
mov eax, dword [esp + 0x418]
lea ecx, [esp + 0x20c]
push eax
push 0x59e450
push ecx
call fcn.004d5ee1
mov edx, dword [esp + 0x428]
lea eax, [esp + 0x10]
push edx
push 0x5b96a0
push str._s._s
push eax
call fcn.004d5ee1
lea ecx, [esp + 0x20]
push ecx
call fcn.004d6713
add esp, 0x20
lea edx, [eax + eax + 2]
lea eax, [esp + 4]
lea ecx, [esp + 0x20c]
push edx
mov edx, dword [esp + 4]
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x414
ret
Function at 0x49aba0
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov eax, dword [esp + 0x18]
sub esp, 0x414
test eax, eax
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
push edi
lea eax, [esp + 0x14]
je 0x49acbe
mov edi, dword [esp + 0x428]
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts._s
push eax
call fcn.004d5ee1
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueW]
add esp, 0xc
lea ecx, [esp + 0x14]
push 0
push 0x5aae60
push 1
push ecx
push 0x80000001
call ebx
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push 0xf003f
push 0
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [esp + 0x42c]
test eax, eax
jne 0x49ac5f
push esi
push 0x5b96a0
lea ecx, [esp + 0x1c]
push str._s._s
push ecx
call fcn.004d5ee1
lea edx, [esp + 0x24]
push edx
call fcn.004d6713
mov edx, dword [esp + 0x24]
add esp, 0x14
lea eax, [eax + eax + 2]
lea ecx, [esp + 0x14]
push eax
push ecx
push 1
push 0
push str.ProgID
push edx
call ebp
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x444]
test eax, eax
je 0x49ad1a
push esi
push 0x5b96a0
lea ecx, [esp + 0x1c]
push str._s._s
push ecx
call fcn.004d5ee1
push edi
lea edx, [esp + 0x230]
push str.SOFTWAREClasses._s
push edx
call fcn.004d5ee1
lea eax, [esp + 0x30]
push eax
call fcn.004d6713
add esp, 0x20
add eax, eax
lea ecx, [esp + 0x14]
lea edx, [esp + 0x21c]
push eax
push ecx
push 1
push edx
push 0x80000002
call ebx
jmp 0x49ad1a
mov esi, dword [esp + 0x42c]
push esi
push 0x5b96a0
push str._s._s
push eax
call fcn.004d5ee1
mov edi, dword [esp + 0x438]
lea ecx, [esp + 0x22c]
push edi
push str.SOFTWAREClasses._s
push ecx
call fcn.004d5ee1
lea edx, [esp + 0x30]
push edx
call fcn.004d6713
add esp, 0x20
add eax, eax
lea ecx, [esp + 0x21c]
push eax
lea eax, [esp + 0x18]
push eax
push 1
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov edx, dword [esp + 0x43c]
mov eax, dword [esp + 0x438]
mov ecx, dword [esp + 0x434]
push edx
mov edx, dword [esp + 0x434]
push eax
push ecx
push edx
push esi
call fcn.0049a980
mov eax, dword [esp + 0x454]
add esp, 0x14
test eax, eax
je 0x49addc
push esi
push edi
call fcn.0049aaf0
push edi
lea eax, [esp + 0x20]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts._sUserChoice
push eax
call fcn.004d5ee1
add esp, 0x14
lea ecx, [esp + 0x14]
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x49addc
push esi
push 0x5b96a0
lea ecx, [esp + 0x1c]
push str._s._s
push ecx
call fcn.004d5ee1
lea edx, [esp + 0x24]
push edx
call fcn.004d6713
mov edx, dword [esp + 0x24]
add esp, 0x14
lea eax, [eax + eax + 2]
lea ecx, [esp + 0x14]
push eax
push ecx
push 1
push 0
push str.Progid
push edx
call ebp
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x414
ret
Function at 0x49adf0
Capabilities:
Delete registry key
Delete registry value
Persist via default file association registry key
Set registry value

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x40c
test eax, eax
push ebx
push esi
mov esi, dword [esp + 0x418]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push esi
je 0x49aec2
lea eax, [esp + 0x214]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts._s
push eax
call fcn.004d5ee1
add esp, 0xc
lea ecx, [esp + 0xc]
lea edx, [esp + 0x210]
push ecx
push 0xf003f
push 0
push edx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49ae66
mov eax, dword [esp + 0xc]
push str.ProgID
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x42c]
test eax, eax
je 0x49af27
push 0
push 0
push esi
call fcn.0049a700
add esp, 0xc
test eax, eax
je 0x49af27
push esi
lea edx, [esp + 0x14]
push str.SOFTWAREClasses._s
push edx
call fcn.004d5ee1
mov ebx, dword [esp + 0x42c]
push ebx
call fcn.004d6713
add esp, 0x10
add eax, eax
push eax
push ebx
lea eax, [esp + 0x18]
push 1
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
jmp 0x49af27
lea ecx, [esp + 0x14]
push str.SOFTWAREClasses._s
push ecx
call fcn.004d5ee1
mov ebx, dword [esp + 0x42c]
push ebx
call fcn.004d6713
add esp, 0x10
add eax, eax
lea edx, [esp + 0x10]
push eax
push ebx
push 1
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov eax, dword [esp + 0x428]
test eax, eax
je 0x49af27
push esi
lea eax, [esp + 0x214]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts._sUserChoice
push eax
call fcn.004d5ee1
add esp, 0xc
lea ecx, [esp + 0x210]
push ecx
push 0x80000001
call edi
push esi
push 0x5b96a0
lea edx, [esp + 0x18]
push str.SOFTWAREClasses_s._sDefaultIcon
push edx
call fcn.004d5ee1
add esp, 0x10
lea eax, [esp + 0x10]
push eax
push 0x80000002
call edi
push esi
push 0x5b96a0
lea ecx, [esp + 0x18]
push str.SOFTWAREClasses_s._s_shellopencommand
push ecx
call fcn.004d5ee1
add esp, 0x10
lea edx, [esp + 0x10]
push edx
push 0x80000002
call edi
push esi
push 0x5b96a0
lea eax, [esp + 0x18]
push str.SOFTWAREClasses_s._s_shellopen
push eax
call fcn.004d5ee1
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
push 0x80000002
call edi
push esi
push 0x5b96a0
lea edx, [esp + 0x18]
push str.SOFTWAREClasses_s._s_shell
push edx
call fcn.004d5ee1
add esp, 0x10
lea eax, [esp + 0x10]
push eax
push 0x80000002
call edi
push esi
push 0x5b96a0
lea ecx, [esp + 0x18]
push str.SOFTWAREClasses_s._s
push ecx
call fcn.004d5ee1
add esp, 0x10
lea edx, [esp + 0x10]
push edx
push 0x80000002
call edi
pop edi
pop esi
pop ebx
add esp, 0x40c
ret
Function at 0x49c240
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0x1c]
push ebx
push esi
push edi
mov edi, dword [esp + 0x1c]
push eax
push edi
call fcn.004d631b
mov eax, dword [esp + 0x28]
add esp, 8
test eax, eax
je 0x49c270
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
push edi
push ecx
push edx
call fcn.0049aff0
add esp, 0xc
mov esi, dword [esp + 0x10]
cmp esi, 2
jne 0x49c2a6
push 0x5b9260
push 0
push str.UseThumbBMP
push str.Extensions
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x49c2f8
push 0x5a2634
push edi
call fcn.004d5ee1
add esp, 8
pop edi
pop esi
pop ebx
ret
test esi, esi
je 0x49c2b4
cmp esi, 5
je 0x49c2b4
cmp esi, 0x12
jne 0x49c2c2
push 0x5a0a2c
push edi
call fcn.004d631b
add esp, 8
mov ebx, dword [esp + 0x18]
cmp esi, 0x32
jl 0x49c2df
cmp esi, 0x36
jg 0x49c2df
push ebx
push 0x5a2628
push edi
call fcn.004d5ee1
add esp, 0xc
cmp esi, 0x37
jl 0x49c2f8
cmp esi, 0x3d
jg 0x49c2f8
push ebx
push str._s_8
push edi
call fcn.004d5ee1
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x49c300
Capabilities:
Set registry value

Disassembly:
sub esp, 0x24
mov ecx, 8
xor eax, eax
push ebx
push ebp
push esi
push edi
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push eax
call fcn.004d6713
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
add esp, 4
lea ecx, [esp + 0x10]
lea esi, [eax + eax + 2]
push ecx
push str.SOFTWAREClassesAppXvhc4p7vz4b485xfp46hhk3fq3grkdgjg
push 0x80000001
call ebp
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x49c369
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push esi
push edx
push 1
push 0
push str.NoOpenWith
push eax
call edi
mov ecx, dword [esp + 0x10]
push ecx
call ebx
lea edx, [esp + 0x10]
push edx
push str.SOFTWAREClassesAppXk0g4vb8gvt7b93tg50ybcy892pge6jmt
push 0x80000001
call ebp
test eax, eax
jne 0x49c39b
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push esi
push eax
push 1
push 0
push str.NoOpenWith
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call ebx
lea eax, [esp + 0x10]
push eax
push str.SOFTWAREClassesAppX43hnxtbyyps62jhe9sqpdzxn1790zetc
push 0x80000001
call ebp
test eax, eax
jne 0x49c3cc
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push esi
push ecx
push 1
push eax
push str.NoOpenWith
push edx
call edi
mov eax, dword [esp + 0x10]
push eax
call ebx
lea ecx, [esp + 0x10]
push ecx
push str.SOFTWAREClassesAppX9rkaq77s0jzh1tyccadx9ghba15r6t3h
push 0x80000001
call ebp
test eax, eax
jne 0x49c3fd
lea edx, [esp + 0x14]
push esi
push edx
push 1
push eax
mov eax, dword [esp + 0x20]
push str.NoOpenWith
push eax
call edi
mov ecx, dword [esp + 0x10]
push ecx
call ebx
lea edx, [esp + 0x10]
push edx
push str.SOFTWAREClassesAppX6eg8h5sxqq90pv53845wmnbewywdqq5h
push 0x80000001
call ebp
test eax, eax
jne 0x49c42f
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push esi
push eax
push 1
push 0
push str.NoOpenWith
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret