joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a47d4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x5a48ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
call fcn.0059dd50
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
mov eax, dword [eax + 0x30]
call fcn.0042d388
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
mov eax, dword [eax + 0x94]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x14]
add eax, dword [edx + 0xc4]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
call fcn.0042c0b8
mov ebx, eax
neg ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
fild dword [eax + 0x124]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
fmul qword [eax + 0x78]
call fcn.00402c14
add ebx, eax
mov dword [ebp - 8], ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
xor edx, edx
mov dword [eax + 0x108], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
mov eax, dword [eax + 0x44]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x5a48b5
inc ebx
xor esi, esi
push ebp
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
mov eax, dword [eax + 0x44]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x14]
call fcn.005a45a0
pop ecx
inc esi
dec ebx
jne 0x5a4894
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
mov eax, dword [eax + 0x30]
call fcn.0042d388
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_DeleteObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a48f3
lea eax, [ebp - 0x14]
call fcn.004047e0
ret
Function at 0x5a4ba0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5a4ce0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0xa0]
push eax
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebx + 0x9c]
xor edx, edx
xor eax, eax
call fcn.0041e058
lea edx, [ebp - 4]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov esi, 1
mov edx, dword [ebp - 4]
mov eax, 0x5a4cf8
call fcn.00404df4
test eax, eax
je 0x5a4c23
jmp 0x5a4c17
mov eax, dword [ebp - 4]
cmp byte [eax + esi - 1], 1
jne 0x5a4c16
lea eax, [ebp - 4]
mov ecx, 1
mov edx, esi
call fcn.00404d50
jmp 0x5a4c17
inc esi
mov eax, dword [ebp - 4]
call fcn.00404ab0
cmp esi, eax
jl 0x5a4bfb
mov eax, dword [ebp - 4]
call fcn.00404ab0
cmp eax, 2
jle 0x5a4c51
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 2], 0xd
jne 0x5a4c51
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0xa
jne 0x5a4c51
mov edx, eax
sub edx, 2
lea eax, [ebp - 4]
call fcn.00404e3c
mov edx, dword [ebx + 0x30]
mov eax, ebx
call fcn.005a348c
fild dword [ebx + 0x128]
fmul qword [ebx + 0x78]
call fcn.00402c14
push eax
mov eax, dword [ebx + 0x30]
call fcn.0042d388
push eax
call sub.gdi32.dll_SetTextCharacterExtra
push 0xc00
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.00404ab0
push eax
mov eax, dword [ebp - 4]
call fcn.00404cb0
push eax
mov eax, dword [ebx + 0x30]
call fcn.0042d388
push eax
call sub.user32.dll_DrawTextA
fild dword [ebp - 0xc]
fdiv qword [ebx + 0x78]
fadd dword [ebx + 0xa8]
mov eax, dword [ebx + 0xc4]
add eax, eax
mov dword [ebp - 0x18], eax
fild dword [ebp - 0x18]
faddp st(1)
fadd dword [0x5a4cfc]
call fcn.00402c14
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a4ce7
lea eax, [ebp - 4]
call fcn.004047e0
ret
Function at 0x5c6700
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov dword [ebp - 0x208], ecx
mov dword [ebp - 0x204], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5c68be
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.005c754c
mov eax, dword [ebp - 0x204]
lea edx, [esi + 1]
call fcn.0040e668
cmp al, 2
jne 0x5c675e
dec esi
mov eax, ebx
call fcn.005c7560
test al, al
je 0x5c6859
test esi, esi
jge 0x5c6773
xor esi, esi
lea edi, [esi + 1]
lea edx, [ebp - 0x208]
mov eax, ebx
call fcn.005c754c
mov eax, dword [ebp - 0x208]
call fcn.00404ab0
cmp edi, eax
jge 0x5c67ba
lea edx, [ebp - 0x20c]
mov eax, ebx
call fcn.005c754c
mov eax, dword [ebp - 0x20c]
mov al, byte [eax + edi - 1]
mov edx, dword [0x6f17d4]
and eax, 0xff
bt dword [edx], eax
jae 0x5c67ba
inc edi
mov eax, dword [ebx + 0x2b8]
cmp esi, eax
jl 0x5c67c8
mov esi, eax
mov edi, esi
mov ecx, edi
mov edx, edi
mov eax, ebx
call fcn.005c69d8
cmp edi, esi
je 0x5c6851
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetKeyboardState
push esi
lea esi, [ebp - 0x100]
lea edi, [ebp - 0x200]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
pop esi
mov byte [ebp - 0x1f0], 0x81
mov byte [ebp - 0x1db], 0x81
mov byte [ebp - 0x1ef], 0
lea eax, [ebp - 0x200]
push eax
call sub.user32.dll_SetKeyboardState
push 1
push 0x25
push pe_nt_image_headers32
mov eax, ebx
call fcn.00483a1c
push eax
call sub.user32.dll_SendMessageA
push 1
push 0x25
push 0x101
mov eax, ebx
call fcn.00483a1c
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_SetKeyboardState
mov dword [ebx + 0x2ac], esi
jmp 0x5c68a0
test esi, esi
jge 0x5c685f
xor esi, esi
lea edx, [ebp - 0x210]
mov eax, ebx
call fcn.005c754c
mov eax, dword [ebp - 0x210]
call fcn.00404ab0
cmp esi, eax
jl 0x5c6895
lea edx, [ebp - 0x214]
mov eax, ebx
call fcn.005c754c
mov eax, dword [ebp - 0x214]
call fcn.00404ab0
mov esi, eax
mov ecx, esi
mov edx, esi
mov eax, ebx
call fcn.005c69d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c68c5
lea eax, [ebp - 0x214]
mov edx, 5
call fcn.00404804
ret

Function at 0x5de46c
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp byte [ebx + 0x314], 0
je 0x5de4bf
cmp byte [ebx + 0x31c], 0
jne 0x5de4bf
push 0
push 1
push 0x86
mov eax, ebx
call fcn.00483a1c
push eax
call sub.user32.dll_SendMessageA
push 4
mov eax, ebx
call fcn.00483a1c
push eax
call sub.user32.dll_ShowWindow
push 0x13
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, ebx
call fcn.00483a1c
push eax
call sub.user32.dll_SetWindowPos
pop ebx
ret
Function at 0x638a54
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe94
mov edi, eax
mov eax, edi
call fcn.00631a34
mov edx, eax
mov eax, edi
call fcn.00638168
mov ebp, eax
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov byte [esp + 0xd], 0
mov eax, edi
call fcn.00638380
xor al, 1
mov byte [esp + 0xc], al
lea edx, [esp + 0x30]
mov eax, edi
call fcn.005ec640
push edi
lea esi, [esp + 0x34]
lea edi, [esp + 0x12]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
lea eax, [esp + 0xe0]
push eax
call sub.user32.dll_IsRectEmpty
test eax, eax
jne 0x638ac2
mov eax, dword [esp + 0xe4]
mov dword [esp + 0x1a], eax
mov dword [esp + 4], 0xffffffff
mov al, byte [esp + 0xc]
xor al, 1
test al, al
je 0x638ad8
neg dword [esp + 4]
push edi
lea esi, [esp + 0x12]
lea edi, [esp + 0x22]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
test al, al
je 0x638b16
push 0
lea eax, [esp + 0x160]
push eax
mov ecx, dword [esp + 0x2e]
xor edx, edx
mov eax, dword [esp + 0x26]
call fcn.0041e058
push edi
lea esi, [esp + 0x160]
lea edi, [esp + 0x22]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
jmp 0x638b1e
mov eax, dword [esp + 0x2a]
mov dword [esp + 0x22], eax
xor ebx, ebx
mov eax, dword [esp + 0x1a]
sub eax, dword [esp + 0x12]
test eax, eax
jns 0x638b31
add eax, 0xff
sar eax, 8
mov dword [esp], eax
cmp dword [esp], 0
jne 0x638c28
mov dword [esp], 1
jmp 0x638c28
cmp ebx, 0x14
jg 0x638b5c
mov esi, dword [esp + 4]
imul esi, dword [esp]
jmp 0x638b67
inc dword [esp]
mov esi, dword [esp + 4]
imul esi, dword [esp]
mov eax, esi
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
mov eax, ecx
add eax, ebx
cmp ebp, eax
jl 0x638b8e
mov eax, esi
cdq
xor eax, edx
sub eax, edx
mov eax, ebp
sub eax, ebx
sar eax, 1
jns 0x638b8a
adc eax, 0
cmp ecx, eax
jle 0x638b97
mov esi, ebp
sub esi, ebx
imul esi, dword [esp + 4]
push 2
push 0
push 0
lea eax, [esp + 0x1a]
push eax
lea eax, [esp + 0x1e]
push eax
push esi
push 0
mov eax, edi
call fcn.00483a1c
push eax
call sub.user32.dll_ScrollWindowEx
mov eax, esi
cdq
xor eax, edx
sub eax, edx
add ebx, eax
cmp byte [esp + 0xc], 0
jne 0x638be0
mov dword [esp + 0x2a], ebx
mov eax, dword [edi + 0x208]
mov eax, dword [eax + 0x14]
mov edx, 0xff000010
call fcn.0042c6c4
jmp 0x638bfb
mov eax, dword [esp + 0x2a]
sub eax, ebx
mov dword [esp + 0x22], eax
mov edx, dword [edi + 0x70]
mov eax, dword [edi + 0x208]
mov eax, dword [eax + 0x14]
call fcn.0042c6c4
lea edx, [esp + 0x1e]
mov eax, dword [edi + 0x208]
call fcn.0042cdc4
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 8]
cmp eax, 0x190
jg 0x638c22
cmp ebp, ebx
jle 0x638c22
xor eax, eax
jmp 0x638c24
mov al, 1
mov byte [esp + 0xd], al
cmp byte [esp + 0xd], 0
je 0x638b4d
add esp, 0x16c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x672c3c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042ce9c
cmp ebx, dword [ebp - 8]
jge 0x672c9f
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042d2f0
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042d2f0
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042d31c
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x672c65
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x672ca8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042ce9c
cmp ebx, dword [ebp - 8]
jge 0x672d0b
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042d2f0
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042d2f0
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042d31c
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x672cd1
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x6947cb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x6f0996
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x694823
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x6f09b7
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x694819
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x694827
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x6bae3c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6bafbd
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x6f0c40], 0
jne 0x6baf9a
push 0x6f4d58
call sub.kernel32.dll_EnterCriticalSection_1
xor eax, eax
push ebp
push 0x6baf93
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x6f0c40], 0
jne 0x6baf7b
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404e3c
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00404cb0
push eax
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.00409170
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x6bafd4
call fcn.0040ab14
mov eax, dword [ebp - 0xc]
call fcn.00404cb0
push eax
push 0x80000000
call sub.advapi32.dll_RegQueryValueA
test eax, eax
jne 0x6baefc
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404e3c
jmp 0x6baf33
lea eax, [ebp - 8]
mov edx, 0x6baff4
call fcn.00404878
xor eax, eax
push ebp
push 0x6baf29
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004a67e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6baf33
mov eax, dword [ebp - 8]
call fcn.00404cb0
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x6f0c40], eax
cmp dword [0x6f0c40], 0
jne 0x6baf66
mov ecx, dword [0x6f1264]
mov dl, 1
mov eax, dword [0x4084f4]
call fcn.0040dd20
call fcn.004041fc
push 0x6bb000
mov eax, dword [0x6f0c40]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x6f4d70], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6baf9a
push 0x6f4d58
call sub.kernel32.dll_LeaveCriticalSection_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6bafc4
lea eax, [ebp - 0x18]
call fcn.004047e0
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404804
ret
Function at 0x6c64c0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, eax
cmp byte [ebx + 0x87], 0
je 0x6c64fb
cmp dword [ebx + 0x5c], 0
je 0x6c64fb
mov eax, dword [ebx + 0x5c]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb8]
mov edx, eax
mov eax, esi
call fcn.006beba4
xor eax, eax
mov dword [ebx + 0x5c], eax
mov byte [ebx + 0x87], 0
cmp dword [ebx + 0x5c], 0
jne 0x6c6646
cmp dword [ebx + 0x7c], 0
jne 0x6c6521
mov dl, 1
mov eax, dword [0x41cde0]
call fcn.0040393c
mov dword [ebx + 0x7c], eax
cmp dword [ebx + 0xc], 0
je 0x6c661f
mov eax, dword [ebx + 0xc]
push eax
mov al, byte [0x6c664c]
push eax
mov al, byte [0x6c6650]
push eax
push 0
mov eax, dword [ebx + 0x7c]
push eax
mov eax, dword [0x6f12a0]
push eax
mov ecx, dword [ebx + 0x68]
mov dl, 1
mov eax, dword [0x68d3b0]
call fcn.0068f2dc
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x6c6618
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebx + 0x5c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
push eax
mov eax, dword [ebx + 0x64]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb4]
mov edx, eax
mov eax, esi
call fcn.006beba4
lea eax, [ebx + 0x10]
push eax
mov eax, dword [ebx + 0x5c]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xc0]
mov edx, eax
mov eax, esi
call fcn.006beba4
mov eax, dword [ebx + 0x40]
push eax
lea eax, [ebx + 0x70]
mov ecx, 1
mov edx, dword [0x6bc460]
call fcn.00405d70
add esp, 4
mov eax, dword [ebx + 0x30]
cmp eax, 0x1a
jge 0x6c65eb
mov edx, dword [0x6f1660]
mov al, byte [edx + eax]
mov byte [ebx + 0x74], al
jmp 0x6c65fc
cmp eax, 0x1007
jne 0x6c65f8
mov byte [ebx + 0x74], 0x18
jmp 0x6c65fc
mov byte [ebx + 0x74], 0
mov eax, dword [ebx + 0x40]
mov dword [ebx + 0x78], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c6646
mov eax, dword [ebp - 4]
call fcn.0040396c
ret
lea eax, [ebx + 0x5c]
push eax
push 0
push 0
mov eax, dword [ebx + 0x64]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb4]
mov edx, eax
mov eax, esi
call fcn.006beba4
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x40c25a
Capabilities:
Check if file exists
Create process on windows

Disassembly:
mov eax, 0x553f6c
call fcn.004d8d80
sub esp, 0xc
mov eax, dword [0x62b3ec]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0042d320
pop ecx
push dword [esi + 4]
mov byte [ebp - 4], 1
push dword [eax]
lea eax, [ebp - 0x10]
push 0x59f620
push eax
call fcn.00536b61
add esp, 0x10
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.0053da4f
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40c2b9
or ebx, 0xffffffff
jmp 0x40c2fb
push 0x633610
lea ecx, [ebp - 0x14]
call fcn.0053dac3
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push str._s__c___s_
push eax
call fcn.00536b61
add esp, 0xc
push ebx
push ebx
push dword [ebp - 0x14]
push str.regsvr32.exe
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.0053da4f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0053da4f
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40c317
Capabilities:
Delete registry key

Disassembly:
mov eax, 0x553f80
call fcn.004d8d80
sub esp, 0xc
mov eax, dword [0x62b3ec]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
push 0x5a1110
push str.YTApplications
lea eax, [ebp - 0x14]
xor esi, esi
push 0x5a11f0
push eax
mov dword [ebp - 4], esi
call fcn.00536b61
add esp, 0x10
mov ebx, 0x20006
mov edi, SysReAllocString
lea ecx, [ebp - 0x10]
push ebx
push str.ShellExContextMenuHandlers
push edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], esi
call fcn.0040c21c
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40c39e
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x40c38f
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x10], 0
je 0x40c39e
push dword [ebp - 0x10]
call esi
and dword [ebp - 0x10], 0
push ebx
push str.FolderShellExContextMenuHandlers
push edi
lea ecx, [ebp - 0x10]
call fcn.0040c21c
test eax, eax
jne 0x40c3d3
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x40c3c4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x10], 0
je 0x40c3e2
push dword [ebp - 0x10]
call esi
and dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 0
je 0x40c3e2
push dword [ebp - 0x10]
call esi
and dword [ebp - 0x10], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0053da4f
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41a987
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push ebx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 4]
push edi
mov ebx, ecx
push eax
push 0
push dword [ebx + 0x1c]
mov edi, 0x56a860
mov dword [ebp - 8], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov esi, 0x2b4
lea eax, [ebp - 0x2bc]
push esi
push 0
push eax
call fcn.004d8eb0
lea eax, [ebp - 8]
add esp, 0xc
neg eax
sbb eax, eax
lea ecx, [ebp - 4]
and eax, ecx
push 0x4009
lea ecx, [ebp - 0x2bc]
push esi
mov eax, dword [eax]
push ecx
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push eax
push 0
push 0x1109
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp - 8]
lea eax, [ebp - 4]
neg ecx
sbb ecx, ecx
mov dword [ebp - 8], edi
and ecx, eax
call fcn.0041a723
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41ae21
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
push esi
mov esi, 0x2b4
push edi
push esi
lea eax, [ebp - 0x2b4]
push 0
mov edi, ecx
push eax
call fcn.004d8eb0
mov eax, dword [ebp + 8]
add esp, 0xc
or ax, 0x4008
push eax
lea eax, [ebp - 0x2b4]
push esi
push eax
push 0
push dword [edi + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [ebp - 0x2b0]
pop edi
pop esi
leave
ret 4
Function at 0x41b560
Capabilities:
Get common file path

Disassembly:
mov eax, 0x55582c
call fcn.004d8d80
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x34]
xor ebx, ebx
mov eax, dword [esi + 0x1c]
push ecx
mov edi, 0x56a860
push 0x11
push eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
push ebx
push ebx
push 0x110a
mov dword [ebp - 4], ebx
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
lea eax, [ebp - 0x38]
push eax
mov ecx, esi
call fcn.0041b74c
cmp eax, ebx
mov dword [ebp - 0x1c], eax
je 0x41b721
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
call fcn.0053dac3
push 0x633610
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0053dac3
mov eax, dword [0x62b3ec]
mov dword [ebp - 0x14], eax
push 0x5c
push 0x2f
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.0053642d
mov ebx, 0x59f61c
lea ecx, [ebp - 0x18]
push ebx
call fcn.00536b74
and dword [ebp - 0x20], 0
and dword [ebp + 8], 0
push dword [ebp - 0x1c]
push 2
push 0x1102
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x5c
lea eax, [ebp - 0x14]
push dword [ebp + 8]
push dword [ebp - 0x18]
push eax
call fcn.0053e627
test eax, eax
je 0x41b6fa
push ebx
lea ecx, [ebp - 0x10]
call fcn.00536b74
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], 0
jne 0x41b665
lea eax, [ebp - 0x14]
push ebx
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0053dcf4
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.0053de7c
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x24]
jmp 0x41b687
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push ebx
push eax
call fcn.0053dd68
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.0053de7c
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
call fcn.0053da4f
and dword [ebp - 0x2c], 0
push 0
mov byte [ebp - 4], 6
push dword [ebp - 0x10]
mov dword [ebp - 0x30], edi
call fcn.0041a49b
pop ecx
mov dword [ebp - 0x2c], eax
pop ecx
push dword [ebp - 0x1c]
lea eax, [ebp - 0x30]
mov ecx, esi
mov byte [ebp - 4], 7
push eax
call fcn.0041b74c
test eax, eax
mov dword [ebp - 0x20], eax
je 0x41b6e2
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], eax
neg ecx
sbb ecx, ecx
lea eax, [ebp - 0x2c]
and ecx, eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x30], edi
call fcn.0041a723
inc dword [ebp + 8]
jmp 0x41b603
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0x2c]
neg ecx
sbb ecx, ecx
mov byte [ebp - 4], 3
and ecx, eax
mov dword [ebp - 0x30], edi
call fcn.0041a723
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.0053da4f
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0053da4f
and byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.0053da4f
mov ebx, dword [ebp - 0x20]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
neg ecx
sbb ecx, ecx
lea eax, [ebp - 0x34]
and ecx, eax
mov dword [ebp - 0x38], edi
call fcn.0041a723
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x41bebc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
push dword [esi + 0x74]
call dword [eax + 0xb8]
xor edi, edi
mov dword [esi + 0x48], edi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push 1
push edi
push edi
call ebx
push edi
push 1
push edi
push edi
mov dword [esi + 0x40], eax
call ebx
mov dword [esi + 0x44], eax
lea eax, [ebp - 4]
push eax
push 2
push esi
push 0x41be63
push edi
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x5c]
cmp eax, edi
jbe 0x41bf22
push 0x11
push edi
push dword [esi + 0x40]
push 5
push eax
call dword [sym.imp.WINMM.dll_timeSetEvent]
mov dword [esi + 0x58], eax
pop edi
pop esi
pop ebx
leave
ret