joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4270e9
Capabilities:
Check if file exists
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
test ebx, ebx
je 0x4271aa
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4271aa
push esi
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.004670a0
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
push esi
mov word [ebp - 0x20c], ax
xor esi, esi
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.004670a0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push esi
push str.SelfProtectAPI2
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push esi
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [edi + 0x2c]
call fcn.004025eb
push ebx
lea ecx, [edi + 0x30]
call fcn.004025eb
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0046711a
leave
ret 4

Function at 0x427268
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 0xc
mov eax, 0x488234
call fcn.004677c7
mov ebx, dword [ebp + 0x80c]
test ebx, ebx
jne 0x42729d
xor eax, eax
jmp 0x427341
push 0x800
lea eax, [ebp]
push 0
push eax
call fcn.004670a0
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
xor edi, edi
push str.SOFTWAREKasperskyLabSetupFolders
inc edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], 0x800
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x427296
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.004029f9
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00408131
push 0x22
lea ecx, [ebp - 0x10]
call fcn.00422c49
lea ecx, [ebp - 0x10]
call fcn.004080bb
push 0x22
lea ecx, [ebp - 0x10]
call fcn.00426bf3
push str.avp.exe
push dword [ebp - 0x10]
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x427334
xor edi, edi
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004023e9
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.0046711a
add ebp, 0x804
leave
ret 4
Function at 0x427f7f
Capabilities:
Check if file exists

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 0xc
mov eax, 0x48834a
call fcn.004677c7
mov dword [ebp - 0x18], ecx
mov ebx, dword [ebp + 0x80c]
push 0x800
xor edi, edi
lea eax, [ebp]
push edi
push eax
call fcn.004670a0
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push str.360safe360move
push ebx
lea eax, [ebp]
push eax
call esi
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x428075
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.004029f9
push str.360safe_move
push ebx
lea eax, [ebp]
push eax
mov dword [ebp - 4], edi
call esi
lea eax, [ebp]
push eax
push edi
mov edi, dword [sym.imp.SHELL32.dll_SHCreateDirectory]
call edi
mov ecx, dword [ebp - 0x18]
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
call fcn.00425bd9
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.004029f9
push str.360safe
push ebx
lea eax, [ebp]
push eax
mov byte [ebp - 4], 1
call esi
lea eax, [ebp]
push eax
call fcn.0041f5eb
pop ecx
push dword [ebp - 0x10]
push 0
call edi
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
push dword [ebp - 0x14]
call fcn.00425bd9
push dword [ebp - 0x14]
call fcn.0041f5eb
pop ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004023e9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.0046711a
add ebp, 0x804
leave
ret 4

Function at 0x42809a
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
mov edi, ecx
call fcn.004670a0
add esp, 0xc
push str.safemonSelfProtectAPI2.dll
push esi
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x804]
push eax
mov ecx, edi
call fcn.004270e9
xor esi, esi
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x42810f
inc esi
cmp esi, 0xa
jl 0x4280ed
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0046711a
leave
ret 4
Function at 0x428519
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x194], eax
push ebx
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetMalloc]
push edi
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x80], ecx
call esi
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov edi, dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
jl 0x42858e
lea eax, [ebp - 0x7c]
push eax
push 0x23
push 0
call ebx
test eax, eax
jl 0x428585
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x7c]
call edi
mov ecx, dword [ebp - 0x80]
lea eax, [ebp - 0x74]
push eax
call fcn.00427f7f
mov eax, dword [ebp - 0x78]
push dword [ebp - 0x7c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x78]
push eax
call esi
test eax, eax
jl 0x4285d0
lea eax, [ebp - 0x7c]
push eax
push 0x1a
push 0
call ebx
test eax, eax
jl 0x4285c7
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x7c]
call edi
mov ecx, dword [ebp - 0x80]
lea eax, [ebp - 0x74]
push eax
call fcn.00427f7f
mov eax, dword [ebp - 0x78]
push dword [ebp - 0x7c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp + 0x194]
pop edi
xor eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.0046711a
add ebp, 0x198
leave
ret

Function at 0x428749
Capabilities:
Get user security identifier

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x198], eax
mov eax, dword [ebp + 0x1a4]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x78], 0x104
cmp eax, edi
je 0x4287e2
mov esi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea ecx, [ebp - 0x7c]
push ecx
lea ecx, [ebp - 0x78]
push ecx
lea ecx, [ebp - 0x70]
push ecx
lea ecx, [ebp - 0x74]
push ecx
push edi
push eax
push edi
mov dword [ebp - 0x74], edi
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4287e2
cmp dword [ebp - 0x74], edi
je 0x4287e2
push dword [ebp - 0x74]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
cmp ebx, edi
je 0x4287e2
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push dword [ebp - 0x80]
push edi
call esi
test eax, eax
je 0x4287db
mov eax, ebx
jmp 0x4287e4
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov ecx, dword [ebp + 0x198]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046711a
add ebp, 0x19c
leave
ret 4
Function at 0x428869
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0
je 0x4288df
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_GetExplicitEntriesFromAclW]
test eax, eax
jne 0x4288df
push edi
mov edi, dword [ebp - 4]
dec edi
js 0x4288de
push esi
mov esi, edi
shl esi, 5
mov eax, dword [ebp - 8]
add eax, esi
mov ecx, dword [eax + 4]
cmp ecx, dword [ebp + 0xc]
jne 0x4288d5
cmp dword [ebp + 0x10], 0
je 0x4288cb
cmp dword [eax + 0x14], 0
jne 0x4288d5
push dword [ebp + 0x10]
add eax, 0xc
push eax
call dword [sym.imp.ADVAPI32.dll_GetTrusteeNameW]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x4288d5
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_DeleteAce]
dec edi
sub esi, 0x20
test edi, edi
jge 0x42889a
pop esi
pop edi
leave
ret 0xc

Function at 0x428fca
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 8

Function at 0x42901b
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x42902c
push 0xd
pop eax
jmp 0x429059
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x42902f
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
ret 8

Function at 0x429595
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x198], eax
mov eax, dword [ebp + 0x1a4]
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
push edi
or ecx, 0x2001f
push ecx
push eax
push dword [esi]
xor edi, edi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x6c], edi
call fcn.0040b881
mov ebx, eax
cmp ebx, edi
je 0x429605
lea ecx, [ebp - 0x70]
call fcn.0040b8c2
mov eax, ebx
mov ecx, dword [ebp + 0x198]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046711a
add ebp, 0x19c
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x42961d
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x70]
call fcn.00429595
cmp eax, edi
jne 0x429650
lea eax, [ebp - 0x80]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x68]
push eax
push edi
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x100
call ebx
test eax, eax
je 0x42960d
lea ecx, [ebp - 0x70]
call fcn.0040b8c2
push dword [ebp - 0x78]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.0040b8c2
mov eax, esi
jmp 0x4295eb
Function at 0x42ade0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x194], eax
push ebx
mov ebx, dword [ebp + 0x1a0]
push edi
xor edi, edi
xor eax, eax
mov dword [ebp - 0x7c], edi
push 0x206
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push edi
push eax
call fcn.004670a0
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
push 0x20019
push edi
push 0x4a0a38
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x78], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42ae73
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push edi
push 0x4970c4
push dword [ebp - 0x78]
mov dword [ebp - 0x80], 0x206
mov dword [ebp - 0x7c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x74]
push eax
mov ecx, ebx
call fcn.004029f9
mov ecx, dword [ebp + 0x194]
pop edi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0046711a
add ebp, 0x198
leave
ret 4

Function at 0x42af62
Capabilities:
Check if file exists

Disassembly:
push 4
mov eax, 0x48b133
call fcn.004677c7
mov esi, ecx
mov eax, dword [esi + 0x60]
test eax, eax
jne 0x42afa7
push str.UtilsSiteUIProxy.dll
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0042ad67
add esp, 0xc
push dword [ebp - 0x10]
and dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42afad
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004023e9
xor eax, eax
call fcn.0046789f
ret
push dword [ebp - 0x10]
call fcn.00402118
test eax, eax
jne 0x42afca
xor esi, esi
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004023e9
mov eax, esi
jmp 0x42afa7
call fcn.00428d0d
mov dword [esi + 0x60], eax
test eax, eax
je 0x42afde
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0xc]
mov esi, dword [esi + 0x60]
jmp 0x42afbb

Function at 0x42b02c
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
xor eax, eax
push esi
mov esi, 0x4c2590
cmp ax, word [0x4c2590]
jne 0x42b084
push 1
push 0x23
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x42b061
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 9
push 0x4a0ce8
push esi
call fcn.004686e1
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42b084
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp + 8]
push esi
call fcn.004029f9
mov eax, dword [ebp + 8]
pop esi
leave
ret 4
Function at 0x42b392
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x1a8
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push ebx
push esi
push edi
push 6
pop ecx
mov esi, 0x490aa0
lea edi, [ebp + 0x58]
rep movsd dword es:[edi], dword [esi]
push 0xd3a
lea eax, [ebp + 0x58]
push 0x1a
mov ebx, 0x104
push eax
mov dword [ebp - 0x12c], 1
mov dword [ebp - 0x130], ebx
movsw word es:[edi], word [esi]
call fcn.0042b354
add esp, 0xc
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x12c]
push eax
push str.ExeString
lea eax, [ebp + 0x58]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x42b427
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x42b427
xor eax, eax
inc eax
jmp 0x42b538
push ebx
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.004670a0
add esp, 0xc
push 0xf
pop ecx
lea eax, [ebp + 0x1c]
push 0xd3c
mov esi, 0x493644
lea edi, [ebp + 0x1c]
push eax
mov dword [ebp - 0x12c], 1
mov dword [ebp - 0x130], ebx
rep movsd dword es:[edi], dword [esi]
call fcn.00468130
pop ecx
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.0042b354
add esp, 0xc
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x12c]
push eax
push 0x4a0d98
lea eax, [ebp + 0x1c]
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x42b4b4
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x42b41f
push ebx
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.004670a0
push 0xf
pop ecx
mov esi, 0x493604
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
push 0xd3c
lea eax, [ebp - 0x24]
push 0x3d
push eax
mov dword [ebp - 0x12c], 1
mov dword [ebp - 0x130], ebx
movsb byte es:[edi], byte [esi]
call fcn.0042b354
add esp, 0x18
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x12c]
push eax
push 0x4a0d98
lea eax, [ebp - 0x24]
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x42b536
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x42b41f
xor eax, eax
mov ecx, dword [ebp + 0x74]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046711a
add ebp, 0x78
leave
ret
Function at 0x42b54a
Capabilities:
Check if file exists
Enumerate files on windows
Get common file path
Get program files directory

Disassembly:
push ebp
lea ebp, [esp - 0x81c]
sub esp, 0x89c
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x818], eax
push ebx
push esi
push edi
xor eax, eax
push eax
push 0x26
lea ecx, [ebp + 0x5ec]
push ecx
push eax
mov dword [ebp - 0x78], eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x42b6f7
mov esi, 0x493694
lea edi, [ebp + 0x7f4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, 0x493684
lea edi, [ebp + 0x808]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0xd3e
push esi
lea eax, [ebp + 0x7f4]
push 0x11
push eax
call fcn.0042b354
push esi
lea eax, [ebp + 0x808]
push 0xe
push eax
call fcn.0042b354
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0x18
lea eax, [ebp + 0x7f4]
push eax
call edi
mov esi, eax
inc esi
mov ebx, 0x3fffffff
cmp esi, ebx
jle 0x42b5ed
and dword [ebp - 0x80], 0
jmp 0x42b60a
lea eax, [esi + esi]
call fcn.00469390
mov eax, esp
push 3
push esi
lea ecx, [ebp + 0x7f4]
push ecx
push eax
call fcn.0042b31c
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0x808]
push eax
call edi
mov esi, eax
inc esi
cmp esi, ebx
jle 0x42b620
and dword [ebp - 0x7c], 0
jmp 0x42b63d
lea eax, [esi + esi]
call fcn.00469390
mov eax, esp
push 3
push esi
lea ecx, [ebp + 0x808]
push ecx
push eax
call fcn.0042b31c
mov dword [ebp - 0x7c], eax
push dword [ebp - 0x80]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp + 0x5ec]
push eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x493680
lea eax, [ebp + 0x5ec]
push eax
lea eax, [ebp + 0x1dc]
push eax
call edi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x1dc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42b6f4
test byte [ebp - 0x74], 0x10
je 0x42b6d5
cmp word [ebp - 0x48], 0x2e
jne 0x42b6a4
cmp word [ebp - 0x46], 0
je 0x42b6d5
cmp word [ebp - 0x46], 0x2e
jne 0x42b6a4
cmp word [ebp - 0x44], 0
je 0x42b6d5
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp + 0x5ec]
push eax
lea eax, [ebp + 0x3e4]
push eax
call edi
push dword [ebp - 0x7c]
lea eax, [ebp + 0x3e4]
push eax
call esi
lea eax, [ebp + 0x3e4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42b6e6
lea eax, [ebp - 0x74]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x42b682
jmp 0x42b6ed
mov dword [ebp - 0x78], 1
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x78]
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x818]
xor ecx, ebp
call fcn.0046711a
add ebp, 0x81c
leave
ret
Function at 0x42b715
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x493684
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, 0xd3e
movsd dword es:[edi], dword [esi]
push ebx
lea eax, [ebp - 0x24]
push 0xe
push eax
movsw word es:[edi], word [esi]
call fcn.0042b354
mov esi, 0x4936a8
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push ebx
lea eax, [ebp - 0x14]
push 0xd
push eax
movsb byte es:[edi], byte [esi]
call fcn.0042b354
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
and dword [ebp - 0x258], 0
add esp, 0x18
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x250], 0x22c
call edi
mov esi, eax
inc esi
mov ebx, 0x3fffffff
cmp esi, ebx
jle 0x42b796
and dword [ebp - 0x254], 0
jmp 0x42b7b3
lea eax, [esi + esi]
call fcn.00469390
mov eax, esp
push 3
push esi
lea ecx, [ebp - 0x24]
push ecx
push eax
call fcn.0042b31c
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x14]
push eax
call edi
mov esi, eax
inc esi
cmp esi, ebx
jle 0x42b7c4
xor ebx, ebx
jmp 0x42b7dd
lea eax, [esi + esi]
call fcn.00469390
mov eax, esp
push 3
push esi
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.0042b31c
mov ebx, eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x42b84f
lea eax, [ebp - 0x250]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x42b848
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
push dword [ebp - 0x254]
lea eax, [ebp - 0x22c]
push eax
call esi
test eax, eax
je 0x42b83e
cmp dword [ebp + 8], 0
jne 0x42b82b
push ebx
lea eax, [ebp - 0x22c]
push eax
call esi
test eax, eax
je 0x42b83e
lea eax, [ebp - 0x250]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x42b804
jmp 0x42b848
mov dword [ebp - 0x258], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x258]
lea esp, [ebp - 0x264]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046711a
leave
ret
Function at 0x42b88e
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xa8]
sub esp, 0x128
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0xa4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x77]
push 0
push eax
mov byte [ebp - 0x78], 0
call fcn.004670a0
add esp, 0xc
push 6
pop ecx
lea eax, [ebp + 0x8c]
push 0x237f
mov esi, 0x4936b8
lea edi, [ebp + 0x8c]
push eax
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x80], 0x104
rep movsd dword es:[edi], dword [esi]
call fcn.00468130
pop ecx
push eax
lea eax, [ebp + 0x8c]
push eax
call fcn.0042b354
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x4a0d98
lea eax, [ebp + 0x8c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
pop edi
pop esi
test eax, eax
jne 0x42b93e
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x42b93e
xor eax, eax
inc eax
jmp 0x42b940
xor eax, eax
mov ecx, dword [ebp + 0xa4]
xor ecx, ebp
call fcn.0046711a
add ebp, 0xa8
leave
ret
Function at 0x42b955
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x4936e0
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, 0x237f
lea eax, [ebp - 0x24]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.00468130
pop ecx
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0042b354
mov esi, 0x4936d0
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push ebx
push eax
movsb byte es:[edi], byte [esi]
call fcn.00468130
pop ecx
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0042b354
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
and dword [ebp - 0x258], 0
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x250], 0x22c
call edi
mov esi, eax
inc esi
mov ebx, 0x3fffffff
cmp esi, ebx
jle 0x42b9eb
and dword [ebp - 0x254], 0
jmp 0x42ba08
lea eax, [esi + esi]
call fcn.00469390
mov eax, esp
push 3
push esi
lea ecx, [ebp - 0x24]
push ecx
push eax
call fcn.0042b31c
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x14]
push eax
call edi
mov esi, eax
inc esi
cmp esi, ebx
jle 0x42ba19
xor ebx, ebx
jmp 0x42ba32
lea eax, [esi + esi]
call fcn.00469390
mov eax, esp
push 3
push esi
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.0042b31c
mov ebx, eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x42baa4
lea eax, [ebp - 0x250]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x42ba9d
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
push dword [ebp - 0x254]
lea eax, [ebp - 0x22c]
push eax
call esi
test eax, eax
je 0x42ba93
cmp dword [ebp + 8], 0
jne 0x42ba80
push ebx
lea eax, [ebp - 0x22c]
push eax
call esi
test eax, eax
je 0x42ba93
lea eax, [ebp - 0x250]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x42ba59
jmp 0x42ba9d
mov dword [ebp - 0x258], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x258]
lea esp, [ebp - 0x264]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046711a
leave
ret