joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436f3e
Capabilities:
Print debug messages
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x59cd24]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov ecx, esi
call fcn.004263be
test eax, eax
jne 0x436f73
push str.strFilePath.GetLength_____0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x4370e0
push edi
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004c4160
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push str._SYSTEMROOT_SYSTEM32wintrust.dll
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x4370c9
push str.WinVerifyTrust
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x238], eax
test eax, eax
je 0x4370c9
xorps xmm0, xmm0
mov dword [ebp - 0x248], 0x10
mov ecx, esi
movlpd qword [ebp - 0x240], xmm0
call fcn.004109c3
mov dword [ebp - 0x244], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x248]
movlpd qword [ebp - 0x278], xmm0
mov dword [ebp - 0x264], eax
xor esi, esi
lea eax, [ebp - 0x27c]
movlpd qword [ebp - 0x260], xmm0
push eax
lea eax, [ebp - 0x21c]
movlpd qword [ebp - 0x258], xmm0
push eax
inc esi
movlpd qword [ebp - 0x250], xmm0
push 0xffffffffffffffff
mov dword [ebp - 0x27c], 0x34
mov dword [ebp - 0x270], 2
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x268], esi
mov dword [ebp - 0x21c], 0xaac56b
mov dword [ebp - 0x218], 0x11d0cd44
mov dword [ebp - 0x214], 0xc000c28c
mov dword [ebp - 0x210], 0xee95c24f
call dword [ebp - 0x238]
mov dword [ebp - 0x238], eax
test eax, eax
je 0x4370c5
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.Verify_the_digital_signature_fail
call esi
push dword [ebp - 0x238]
lea eax, [ebp - 0x234]
push eax
call fcn.004373b2
pop ecx
pop ecx
mov ecx, eax
call fcn.004109c3
push eax
call esi
lea ecx, [ebp - 0x234]
call fcn.0041be74
jmp 0x4370d8
mov ebx, esi
jmp 0x4370d8
push str.pfnWinVerifyTrust__NULL
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test edi, edi
je 0x4370df
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.0049fb26
leave
ret
Function at 0x437128
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x59cd24]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 5
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x43717c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
cmp ecx, 5
je 0x437172
xor eax, eax
cmp ecx, 0x429
setne al
add eax, 0xfe
jmp 0x437271
mov eax, 0xfd
jmp 0x437271
push 4
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x4371e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
sub esi, 5
je 0x4371da
sub esi, 1
je 0x4371d0
sub esi, 0x75
je 0x4371c6
sub esi, 0x3a9
je 0x4371bc
mov eax, 0xef
jmp 0x437271
mov eax, 0xee
jmp 0x437271
mov eax, 0xed
jmp 0x437271
mov eax, 0xec
jmp 0x437271
mov eax, 0xeb
jmp 0x437271
imul eax, dword [ebp + 0xc], 0x3e8
mov dword [ebp - 0x2c], edi
mov edi, 0xcf
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x30], eax
test eax, eax
je 0x437263
lea eax, [ebp - 0x34]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x437242
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7c
jbe 0x437280
cmp eax, 0x41c
je 0x43724a
cmp eax, 0x424
jbe 0x437296
cmp eax, 0x426
jbe 0x43724a
cmp eax, 0x45b
jne 0x437296
mov edi, 0xde
jmp 0x43729b
mov edi, dword [ebp - 0x24]
cmp edi, 1
je 0x437263
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2c]
add eax, 0x32
mov dword [ebp - 0x2c], eax
cmp eax, dword [ebp - 0x30]
jb 0x4371fd
mov edi, dword [ebp - 0x24]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049fb26
leave
ret
je 0x4372bc
sub eax, 5
je 0x4372b5
sub eax, 1
je 0x4372ae
sub eax, 0x51
je 0x4372a7
sub eax, 0x23
je 0x4372a0
mov edi, 0xdf
mov dword [ebp - 0x24], edi
jmp 0x437263
mov edi, 0xdb
jmp 0x43729b
mov edi, 0xdc
jmp 0x43729b
mov edi, 0xd9
jmp 0x43729b
mov edi, 0xda
jmp 0x43729b
mov edi, 0xdd
jmp 0x43729b
Function at 0x4372c3
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push str.GlobalWaitForUpdateCommandExcuted
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
test esi, esi
je 0x43734f
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 7
mov dword [ebp - 4], eax
lea edi, [ebp - 0x20]
pop ecx
xor eax, eax
mov ebx, 0x102
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x437335
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, eax
test ebx, ebx
je 0x437344
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, dword [ebp + 8]
jae 0x437344
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x20]
push eax
call edi
test eax, eax
jne 0x437304
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, ebx
pop ebx
pop esi
leave
ret

Function at 0x43758b
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x59cd24]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x1fe
xor edi, edi
lea eax, [ebp - 0x204]
push edi
push eax
call fcn.004c4160
push 0x208
lea eax, [ebp - 0x40c]
push edi
push eax
call fcn.004c4160
add esp, 0x18
mov dword [ebp - 0x42c], 0x104
lea eax, [ebp - 0x418]
mov dword [ebp - 0x414], edi
xorps xmm0, xmm0
mov dword [ebp - 0x428], edi
mov ebx, SysReAllocStringLen
mov dword [ebp - 0x424], edi
push edi
push edi
push eax
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x420], edi
push eax
lea eax, [ebp - 0x420]
mov dword [ebp - 0x41c], edi
push eax
lea eax, [ebp - 0x424]
mov dword [ebp - 0x418], edi
push eax
lea eax, [ebp - 0x428]
movlpd qword [ebp - 0x438], xmm0
push eax
lea eax, [ebp - 0x414]
push eax
push edi
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x40c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [ebp - 0x414]
test eax, eax
je 0x4376cb
push esi
mov esi, edi
lea eax, [ebp - 0x438]
mov dword [ebp - 0x430], 0xff
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4376c1
lea eax, [ebp - 0x410]
mov dword [ebp - 0x410], edi
push eax
push 0xf003f
push edi
lea eax, [ebp - 0x204]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4376c1
push dword [ebp - 0x410]
call fcn.00437a8a
pop ecx
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
cmp esi, dword [ebp - 0x414]
jb 0x437656
pop esi
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
inc eax
pop ebx
call fcn.0049fb26
leave
ret
Function at 0x437aad
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x59cd24]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x1fe
xor edi, edi
lea eax, [ebp - 0x204]
push edi
push eax
call fcn.004c4160
push 0x208
lea eax, [ebp - 0x40c]
push edi
push eax
call fcn.004c4160
add esp, 0x18
mov dword [ebp - 0x42c], 0x104
lea eax, [ebp - 0x418]
mov dword [ebp - 0x414], edi
xorps xmm0, xmm0
mov dword [ebp - 0x428], edi
mov ebx, SysReAllocStringLen
mov dword [ebp - 0x424], edi
push edi
push edi
push eax
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x420], edi
push eax
lea eax, [ebp - 0x420]
mov dword [ebp - 0x41c], edi
push eax
lea eax, [ebp - 0x424]
mov dword [ebp - 0x418], edi
push eax
lea eax, [ebp - 0x428]
movlpd qword [ebp - 0x438], xmm0
push eax
lea eax, [ebp - 0x414]
push eax
push edi
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x40c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [ebp - 0x414]
test eax, eax
je 0x437bed
push esi
mov esi, edi
lea eax, [ebp - 0x438]
mov dword [ebp - 0x430], 0xff
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x437be3
lea eax, [ebp - 0x410]
mov dword [ebp - 0x410], edi
push eax
push 0xf003f
push edi
lea eax, [ebp - 0x204]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x437be3
push dword [ebp - 0x410]
call fcn.00437cf0
pop ecx
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
cmp esi, dword [ebp - 0x414]
jb 0x437b78
pop esi
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
inc eax
pop ebx
call fcn.0049fb26
leave
ret

Function at 0x437bfe
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x59cd24]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
lea eax, [ebp - 0x20c]
push 0x208
push ebx
push eax
mov dword [ebp - 0x210], ebx
call fcn.004c4160
add esp, 0xc
lea eax, [ebp - 0x214]
mov esi, ebx
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
jmp 0x437ca4
lea eax, [ebp - 0x210]
push eax
push 0xf003f
push ebx
lea eax, [ebp - 0x20c]
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x437c90
push ebx
push str.SoftwareClasseswbxappwin
push dword [ebp - 0x210]
call fcn.0042aabe
add esp, 0xc
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x210], ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x214]
inc esi
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push SysReAllocStringLen
mov dword [ebp - 0x214], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x437c47
call fcn.00437aad
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.0049fb26
leave
ret
Function at 0x439aa2
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push ecx
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 4]
push esi
push eax
push 0x20
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x439b51
push ebx
push edi
push 0x28
call fcn.004f54a1
mov ebx, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov edi, eax
pop ecx
lea eax, [edi + 4]
push eax
push str.SeDebugPrivilege
push esi
call ebx
test eax, eax
je 0x439b48
lea eax, [edi + 0x10]
push eax
push str.SeBackupPrivilege
push esi
call ebx
test eax, eax
je 0x439b48
lea eax, [edi + 0x1c]
push eax
push str.SeRestorePrivilege
push esi
call ebx
test eax, eax
je 0x439b48
push 3
pop ecx
mov dword [edi], ecx
lea eax, [edi + 0xc]
mov dword [eax], 2
lea eax, [eax + 0xc]
sub ecx, 1
jne 0x439b12
push esi
push esi
push 0x28
push edi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x439b48
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x439b48
push edi
call fcn.004cdece
xor esi, esi
inc esi
jmp 0x439b4e
push edi
call fcn.004cdece
pop ecx
pop edi
pop ebx
mov eax, dword [ebp - 4]
test eax, eax
je 0x439b64
cmp eax, 0xffffffff
je 0x439b64
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
leave
ret

Function at 0x43bf7e
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc34
mov eax, dword [0x59cd24]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x43c05d
push edi
mov edi, 0x410
lea eax, [ebp - 0x414]
push edi
push 0
push eax
call fcn.004c4160
add esp, 0xc
lea eax, [ebp - 0x414]
push str.configuration
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push eax
call esi
push str.org.eclipse.update
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push edi
lea eax, [ebp - 0x824]
push 0
push eax
call fcn.004c4160
add esp, 0xc
lea eax, [ebp - 0x414]
push str.last.config.stamp.bak
push eax
lea eax, [ebp - 0x824]
push eax
call esi
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43c021
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
lea eax, [ebp - 0xc34]
push 0
push eax
call fcn.004c4160
add esp, 0xc
lea eax, [ebp - 0x414]
push str.last.config.stamp
push eax
lea eax, [ebp - 0xc34]
push eax
call esi
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0xc34]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0049fb26
leave
ret
Function at 0x43c06a
Capabilities:
Create process on windows

Disassembly:
push 0x474
mov eax, 0x52f4a4
call fcn.0049fba2
mov edi, 0x208
lea eax, [ebp - 0x218]
push edi
xor ebx, ebx
push ebx
push eax
call fcn.004c4160
mov esi, 0x104
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.0043c867
add esp, 0x14
lea eax, [ebp - 0x218]
push 0x547050
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push edi
lea eax, [ebp - 0x420]
push ebx
push eax
call fcn.004c4160
add esp, 0xc
lea eax, [ebp - 0x420]
push esi
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x478]
push ebx
push eax
call fcn.004c4160
add esp, 0xc
mov dword [ebp - 0x478], esi
cmp dword [ebp + 8], ebx
lea eax, [ebp - 0x420]
mov dword [ebp - 0x468], eax
mov ecx, str._nendupdatefail
mov eax, str._nendupdate
mov dword [ebp - 0x474], 0x240
cmove eax, ecx
mov dword [ebp - 0x470], ebx
mov dword [ebp - 0x464], eax
lea eax, [ebp - 0x478]
push eax
mov dword [ebp - 0x46c], ebx
mov dword [ebp - 0x460], ebx
mov dword [ebp - 0x45c], ebx
mov dword [ebp - 0x458], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x43c198
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str._nLaunching_ptWbxONI.exe_process_failed.EndUpdate_n
lea ecx, [ebp - 0x43c]
call fcn.00407146
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x43c]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 0x480]
call fcn.0040d329
push eax
call fcn.00409482
add esp, 0x28
lea ecx, [ebp - 0x43c]
call fcn.00407a12
call fcn.0049fb4c
ret

Function at 0x43c5dd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push ebx
push esi
push edi
push eax
push 1
xor ebx, ebx
push ebx
push str.SOFTWAREwebexNI
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43c66d
mov esi, dword [ebp + 8]
test esi, esi
je 0x43c66d
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push str.Path
push dword [ebp - 4]
call edi
test eax, eax
jne 0x43c66d
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
ja 0x43c66d
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push ebx
push str.Path
push dword [ebp - 4]
call edi
test eax, eax
jne 0x43c66d
mov edi, str.Notes
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x43c668
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor eax, eax
inc eax
jmp 0x43c66f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43c674
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
je 0x43c6f2
xor edi, edi
cmp dword [0x5912d4], edi
jle 0x43c6f2
mov ebx, str.SOFTWARELotusNotes6.0
and dword [ebp - 4], 0
lea eax, [ebp - 4]
and dword [ebp - 0xc], 0
push eax
push 1
push 0
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43c6e3
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 0
push str.MultiUser
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x43c6f9
inc edi
add ebx, 0x208
cmp edi, dword [0x5912d4]
jl 0x43c692
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
inc eax
jmp 0x43c6f4

Function at 0x43c867
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor esi, esi
push edi
mov edi, esi
cmp dword [0x5912d4], esi
jle 0x43c911
mov ebx, str.SOFTWARELotusNotes6.0
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push 1
push esi
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43c8fe
cmp dword [ebp + 8], eax
je 0x43c8fe
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push str.Path
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43c8f5
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
ja 0x43c8f5
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push esi
push str.Path
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x43c918
xor esi, esi
jmp 0x43c8fe
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc edi
add ebx, 0x208
cmp edi, dword [0x5912d4]
jl 0x43c885
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
inc eax
jmp 0x43c913
Function at 0x43d126
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x59cd24]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
call fcn.004c4160
and dword [ebp - 0x210], 0
lea eax, [ebp - 0x210]
add esp, 0xc
push eax
push 0x1c
push 0
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x43d185
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x43d196
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.0040d441
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0049fb26
leave
ret

Function at 0x43ebc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x14]
cmp dword [ebp + 0x10], ebx
je 0x43ebdf
push edi
push ebx
push dword [ebp + 0x10]
call fcn.004c4160
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x2001f
push ebx
push dword [ebp + 8]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43ec30
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
cmp dword [ebp + 0x1c], ebx
jne 0x43ec0f
push dword [ebp + 0x10]
mov dword [ebp - 8], edi
jmp 0x43ec19
push dword [ebp + 0x18]
mov dword [ebp - 8], 4
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
leave
ret
Function at 0x43eccc
Capabilities:
Check for time delay via gettickcount
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x59cd24]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x218], esi
test edi, edi
je 0x43ee25
test esi, esi
je 0x43ee25
lea eax, [ebp - 0x208]
xor ebx, ebx
push eax
push esi
push edi
mov dword [ebp - 0x208], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x43ee25
push 0x200
lea eax, [ebp - 0x204]
push ebx
push eax
call fcn.004c4160
add esp, 0xc
mov dword [ebp - 0x20c], 0x100
mov dword [ebp - 0x210], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x224]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, dword [ebp + 0x10]
test eax, eax
jne 0x43ee06
mov edi, dword [ebp - 0x210]
mov esi, dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, 0x4e20
ja 0x43edfa
push dword [ebp + 0x14]
test ebx, ebx
lea eax, [ebx - 1]
cmovle eax, ebx
push eax
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x208]
call fcn.0043eccc
add esp, 0x10
test eax, eax
je 0x43edc5
inc edi
lea eax, [ebp - 0x224]
mov dword [ebp - 0x20c], 0x100
push eax
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push edi
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x43ed90
mov esi, dword [ebp - 0x218]
mov edi, dword [ebp - 0x21c]
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x43ee20
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x43ee27
or eax, 0xffffffff
jmp 0x43ee27
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049fb26
leave
ret
Function at 0x43f660
Capabilities:
Check if file exists
Delete file
Enumerate files on windows
Get file attributes

Disassembly:
push 0x694
mov eax, 0x52fc11
call fcn.0049fba2
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test edi, edi
je 0x43f775
test esi, esi
je 0x43f775
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43f6ae
push str.RemoveFilesSpecPostfix:_Spec_file_path_is_not_existed__n
lea ecx, [ebp - 0x43c]
call fcn.00407146
mov dword [ebp - 4], 1
xor esi, esi
jmp 0x43f78a
push edi
lea ecx, [ebp - 0x698]
call fcn.0042ee23
lea eax, [ebp - 0x698]
mov dword [ebp - 4], 2
push esi
push eax
call fcn.0041b43b
pop ecx
pop ecx
lea eax, [ebp - 0x68c]
push eax
lea ecx, [ebp - 0x698]
call fcn.0042ef3d
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x43f765
xor esi, esi
lea eax, [ebp - 0x660]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0x10
je 0x43f74c
push 0x410
lea eax, [ebp - 0x420]
push esi
push eax
call fcn.004c4160
add esp, 0xc
lea eax, [ebp - 0x660]
push eax
push edi
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43f74c
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x68c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x43f6f2
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x698]
call fcn.0042ee5d
xor eax, eax
inc eax
jmp 0x43f7bb
push str.RemoveFilesSpecPostfix:_input_para_is_NULL__n
lea ecx, [ebp - 0x43c]
call fcn.00407146
xor esi, esi
mov dword [ebp - 4], esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x6a0]
call fcn.0040d329
push eax
call fcn.00409398
add esp, 0x28
lea ecx, [ebp - 0x43c]
call fcn.00407a12
xor eax, eax
call fcn.0049fb4c
ret