joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a580
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x18c]
sub esp, 0x20c
mov eax, dword [0x506550]
xor eax, ebp
mov dword [ebp + 0x188], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x194]
xor ebx, ebx
push 0x206
lea eax, [ebp - 0x7e]
push ebx
push eax
mov word [ebp - 0x80], bx
call fcn.0043b4c0
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0xc
push edi
call esi
test eax, eax
jne 0x42a659
push edi
lea eax, [ebp - 0x80]
push 0x4c704c
push eax
call fcn.0043c4d1
lea eax, [ebp - 0x80]
push str..del
push eax
call fcn.0043c416
add esp, 0x14
test eax, eax
je 0x42a5f7
push 5
push ebx
push edi
jmp 0x42a653
test ebx, ebx
lea eax, [ebp - 0x80]
jne 0x42a60f
push edi
push str._s.del
push eax
call fcn.0043c4d1
add esp, 0xc
jmp 0x42a61f
push ebx
push edi
push str._s.del_d
push eax
call fcn.0043c4d1
add esp, 0x10
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42a63f
lea eax, [ebp - 0x80]
push eax
call esi
test eax, eax
jne 0x42a63f
cmp ebx, 0xa
jg 0x42a659
inc ebx
jmp 0x42a5f7
lea eax, [ebp - 0x80]
push eax
push edi
call fcn.0043f4a1
pop ecx
pop ecx
push 5
push 0
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp + 0x188]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043b4a5
add ebp, 0x18c
leave
ret 4

Function at 0x42a6e0
Capabilities:
Delete file

Disassembly:
push 0
mov eax, 0x4c1eed
call fcn.0043c032
mov edi, ecx
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x42a705
lea ecx, [esi - 0x10]
jmp 0x42a71b
lea ecx, [ebp + 8]
call fcn.00429617
push eax
mov ecx, edi
call fcn.0042a580
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040db19
xor eax, eax
inc eax
call fcn.0043c10a
ret 4
Function at 0x42b0c8
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
sub esp, 0x240
lea ebp, [esp - 4]
mov eax, dword [0x506550]
xor eax, ebp
mov dword [ebp + 0x240], eax
push 8
mov eax, 0x4c2091
call fcn.0043c032
mov eax, dword [ebp + 0x254]
mov ebx, dword [ebp + 0x24c]
mov edi, dword [ebp + 0x250]
xor esi, esi
push 0x206
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x3a]
push esi
push eax
mov dword [ebp - 0x14], ecx
mov word [ebp + 0x38], si
call fcn.0043b4c0
add esp, 0xc
push esi
push 0x1a
lea eax, [ebp + 0x38]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x42b1fb
lea eax, [ebp + 0x38]
push str.MicrosoftInternet_ExplorerQuick_Launch
push eax
call fcn.0043b664
pop ecx
pop ecx
lea eax, [ebp + 0x38]
push eax
lea ecx, [ebp + 0x1c]
call fcn.004015c0
push 0x4dfb94
lea ecx, [ebp + 0x1c]
mov dword [ebp - 4], esi
call fcn.004036c0
push edi
lea ecx, [ebp + 0x1c]
call fcn.004036c0
push 0x4c89ac
lea ecx, [ebp + 0x1c]
call fcn.004036c0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp]
push eax
call fcn.0042ae00
mov eax, dword [ebp + 4]
push 8
pop edi
cmp dword [ebp + 0x18], edi
mov byte [ebp - 4], 1
jae 0x42b192
lea eax, [ebp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42b1c8
cmp dword [ebp + 0x18], edi
mov ecx, dword [ebp + 4]
jae 0x42b1a8
lea ecx, [ebp + 4]
cmp dword [ebp + 0x34], edi
mov eax, dword [ebp + 0x20]
jae 0x42b1b3
lea eax, [ebp + 0x20]
push dword [ebp - 0x10]
push esi
push esi
push 1
push ecx
push esi
push ebx
push eax
call fcn.0041bb8d
add esp, 0x20
jmp 0x42b1e5
cmp dword [ebp + 0x34], edi
mov eax, dword [ebp + 0x20]
jae 0x42b1d3
lea eax, [ebp + 0x20]
push dword [ebp - 0x10]
push esi
push esi
push 1
push esi
push ebx
push eax
call fcn.0041bab3
add esp, 0x1c
push esi
push 1
lea ecx, [ebp]
call fcn.004017c0
push esi
push 1
lea ecx, [ebp + 0x1c]
call fcn.004017c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x240]
xor ecx, ebp
call fcn.0043b4a5
add ebp, 0x244
leave
ret 0xc
Function at 0x42b220
Capabilities:
Create process on windows

Disassembly:
push 0x40
mov eax, 0x4c20c9
call fcn.0043c09b
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x2c]
push edi
push eax
mov dword [ebp - 0x4c], ecx
call fcn.0041cb89
pop ecx
pop ecx
xor esi, esi
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], esi
call fcn.004036c0
push 0x4c89ac
lea ecx, [ebp - 0x2c]
call fcn.004036c0
mov ecx, dword [ebp - 0x4c]
lea eax, [ebp - 0x48]
push eax
call fcn.0042ae00
cmp dword [ebp - 0x30], 8
mov ecx, dword [ebp - 0x44]
mov byte [ebp - 4], 1
jae 0x42b278
lea ecx, [ebp - 0x44]
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x42b284
lea eax, [ebp - 0x28]
push 0x4dfbb4
push ecx
mov ecx, dword [ebp - 0x4c]
push esi
push esi
push 1
push esi
push edi
push eax
call fcn.0042a493
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x42b2a5
lea eax, [ebp - 0x28]
push esi
push esi
push esi
push eax
push str.taskbarpin
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push esi
push 1
lea ecx, [ebp - 0x48]
call fcn.004017c0
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.004017c0
call fcn.0043c11e
ret 8
Function at 0x42b335
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
sub esp, 0x42c
lea ebp, [esp - 4]
mov eax, dword [0x506550]
xor eax, ebp
mov dword [ebp + 0x42c], eax
push 0x10
mov eax, 0x4c2116
call fcn.0043c032
mov esi, 0x206
xor edi, edi
push esi
lea eax, [ebp + 0x1e]
push edi
push eax
mov ebx, ecx
mov word [ebp + 0x1c], di
call fcn.0043b4c0
push esi
lea eax, [ebp + 0x226]
push edi
push eax
mov word [ebp + 0x224], di
call fcn.0043b4c0
add esp, 0x18
mov esi, 0x4dfbb4
push esi
lea ecx, [ebp - 0x10]
call fcn.0042995f
push esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
call fcn.0042995f
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.0042995f
push esi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.0042995f
push edi
push 0x17
lea eax, [ebp + 0x1c]
push eax
push edi
mov byte [ebp - 4], 3
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x42b511
push 0x4cc04c
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x224]
push str._s_s_
push eax
call fcn.0043c4d1
lea eax, [ebp + 0x224]
push eax
call fcn.0041ae99
push 0x4cc04c
lea eax, [ebp + 0x224]
push eax
lea eax, [ebp - 0x10]
push str._s_s.lnk
push eax
call fcn.0042a796
add esp, 0x24
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebx + 0x18], 8
jb 0x42b42e
mov eax, dword [ebx + 4]
jmp 0x42b431
lea eax, [ebx + 4]
push str.Wnie.exe
push eax
lea eax, [ebp - 0x14]
push 0x4c7040
push eax
call fcn.0042a796
add esp, 0x10
lea eax, [ebp]
push eax
mov ecx, ebx
call fcn.0042ae00
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
mov byte [ebp - 4], 4
jae 0x42b463
lea eax, [ebp + 4]
push eax
lea eax, [ebp - 0x18]
push 0x4c704c
push eax
call fcn.0042a796
add esp, 0xc
push esi
push dword [ebp - 0x18]
mov ecx, ebx
push edi
push edi
push 1
push edi
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call fcn.0042a493
lea eax, [ebp + 0x224]
push eax
lea eax, [ebp - 0x10]
push 0x4cc0dc
push eax
call fcn.0042a796
add esp, 0xc
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp + 0x224]
push eax
lea eax, [ebp - 0x10]
push 0x4cc0dc
push eax
call fcn.0042a796
add esp, 0xc
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebx + 0x18], 8
jb 0x42b4d8
mov eax, dword [ebx + 4]
jmp 0x42b4db
lea eax, [ebx + 4]
push str.Uninst.exe
push eax
lea eax, [ebp - 0x14]
push 0x4c7040
push eax
call fcn.0042a796
add esp, 0x10
push esi
push edi
push edi
push edi
push 1
push edi
push dword [ebp - 0x14]
mov ecx, ebx
push dword [ebp - 0x10]
call fcn.0042a493
push edi
push 1
lea ecx, [ebp]
call fcn.004017c0
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0040db19
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040db19
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0040db19
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040db19
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x42c]
xor ecx, ebp
call fcn.0043b4a5
add ebp, 0x430
leave
ret
Function at 0x42b560
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x506550]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push edi
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
mov edi, ecx
call fcn.0043b4c0
add esp, 0xc
push 0
push 2
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call fcn.0042b050
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0043b4a5
leave
ret

Function at 0x42b692
Capabilities:
Check if file exists

Disassembly:
push 0x44
mov eax, 0x4c218b
call fcn.0043c09b
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x2c]
push ebx
push eax
mov dword [ebp - 0x4c], ecx
call fcn.0041cb89
pop ecx
pop ecx
xor esi, esi
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], esi
call fcn.004036c0
push 0x4c89ac
lea ecx, [ebp - 0x2c]
call fcn.004036c0
mov ecx, dword [ebp - 0x4c]
lea eax, [ebp - 0x48]
push eax
call fcn.0042ae00
mov eax, dword [ebp - 0x44]
push 8
pop edi
cmp dword [ebp - 0x30], edi
mov byte [ebp - 4], 1
jae 0x42b6f2
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42b728
cmp dword [ebp - 0x30], edi
mov ecx, dword [ebp - 0x44]
jae 0x42b708
lea ecx, [ebp - 0x44]
cmp dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x28]
jae 0x42b713
lea eax, [ebp - 0x28]
push dword [ebp - 0x50]
push esi
push esi
push 1
push ecx
push esi
push ebx
push eax
call fcn.0041bb8d
add esp, 0x20
jmp 0x42b745
cmp dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x28]
jae 0x42b733
lea eax, [ebp - 0x28]
push dword [ebp - 0x50]
push esi
push esi
push 1
push esi
push ebx
push eax
call fcn.0041bab3
add esp, 0x1c
cmp dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x28]
jae 0x42b750
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x4c]
push eax
push 1
call fcn.0042b2d3
push esi
push 1
lea ecx, [ebp - 0x48]
call fcn.004017c0
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.004017c0
call fcn.0043c11e
ret 0xc
Function at 0x42b779
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x224
lea ebp, [esp - 4]
mov eax, dword [0x506550]
xor eax, ebp
mov dword [ebp + 0x224], eax
push 0x1c
mov eax, 0x4c21c0
call fcn.0043c032
xor esi, esi
push 0x206
lea eax, [ebp + 0x1e]
push esi
push eax
mov ebx, ecx
mov word [ebp + 0x1c], si
call fcn.0043b4c0
add esp, 0xc
cmp dword [ebp + 0x230], esi
push esi
lea eax, [ebp + 0x1c]
je 0x42b7e5
push 0x19
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x42b88a
lea eax, [ebp + 0x1c]
push eax
mov ecx, ebx
call fcn.0042b5c2
jmp 0x42b88a
push 0x10
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x42b88a
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp]
call fcn.004015c0
push 0x4dfb94
lea ecx, [ebp]
mov dword [ebp - 4], esi
call fcn.004036c0
mov edi, 0x4cc04c
push edi
lea ecx, [ebp]
call fcn.004036c0
push 0x4c89ac
lea ecx, [ebp]
call fcn.004036c0
push ebx
lea ecx, [ebp - 0x28]
call fcn.004035b0
push str.Wnie.exe
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.004036c0
cmp dword [ebp - 0x10], 8
mov ecx, dword [ebp - 0x24]
jae 0x42b854
lea ecx, [ebp - 0x24]
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x42b860
lea eax, [ebp + 4]
push 0x4dfbb4
push esi
push esi
push esi
push 1
push edi
push ecx
push eax
mov ecx, ebx
call fcn.0042a493
push esi
push 1
lea ecx, [ebp - 0x28]
call fcn.004017c0
push esi
push 1
lea ecx, [ebp]
call fcn.004017c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.0043b4a5
add ebp, 0x228
leave
ret 4

Function at 0x42b8af
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x506550]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push edi
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
mov edi, ecx
call fcn.0043b4c0
add esp, 0xc
push 0
push 0xb
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x42b908
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call fcn.0042b5c2
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0043b4a5
leave
ret

Function at 0x42b915
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x506550]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push edi
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
mov edi, ecx
call fcn.0043b4c0
add esp, 0xc
push 0
push 0x1a
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x42b981
lea eax, [ebp - 0x20c]
push str.MicrosoftInternet_ExplorerQuick_Launch
push eax
call fcn.0043b664
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call fcn.0042b5c2
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0043b4a5
leave
ret
Function at 0x42c778
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3a8]
sub esp, 0x428
mov eax, dword [0x506550]
xor eax, ebp
mov dword [ebp + 0x3a4], eax
push ebx
push esi
mov esi, dword [ebp + 0x3b0]
xor ebx, ebx
cmp esi, ebx
je 0x42c919
push edi
mov edi, 0x103
push edi
lea eax, [ebp + 0x2a1]
push ebx
push eax
mov byte [ebp + 0x2a0], bl
call fcn.0043b4c0
add esp, 0xc
cmp dword [esi + 0x18], 8
jb 0x42c7cd
mov esi, dword [esi + 4]
jmp 0x42c7d0
add esi, 4
lea eax, [ebp + 0x2a0]
push eax
push esi
call fcn.0041af40
push edi
lea eax, [ebp + 0x19d]
push ebx
push eax
mov byte [ebp + 0x19c], bl
call fcn.0043b4c0
add esp, 0x14
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x19c]
push eax
lea eax, [ebp + 0x2a0]
push eax
mov dword [ebp - 0x7c], 0xbb8
call fcn.0043b9a0
pop ecx
push eax
lea eax, [ebp + 0x2a0]
push eax
call fcn.0041ae5d
add esp, 0x10
call fcn.0041c553
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x78]
push eax
mov esi, 0xf003f
push esi
push ebx
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x74], ebx
call edi
test eax, eax
jne 0x42c918
lea eax, [ebp - 0x70]
push eax
push esi
push ebx
push str.CommmonSoft
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x42c88d
push ebx
lea eax, [ebp - 0x70]
push eax
push ebx
push esi
push ebx
push ebx
push ebx
push str.CommmonSoft
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x42c918
lea eax, [ebp - 0x74]
push eax
push esi
push ebx
push str.SoftInfo
push dword [ebp - 0x70]
call edi
test eax, eax
je 0x42c8bd
push ebx
lea eax, [ebp - 0x74]
push eax
push ebx
push esi
push ebx
push ebx
push ebx
push str.SoftInfo
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x42c918
push 0x206
lea eax, [ebp - 0x6a]
push ebx
push eax
mov word [ebp - 0x6c], bx
call fcn.0043b4c0
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x19c]
push eax
call fcn.0041af17
add esp, 0x14
push 4
lea eax, [ebp - 0x80]
push eax
push 4
push ebx
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 0x74], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x42c909
push dword [ebp - 0x74]
call esi
cmp dword [ebp - 0x70], ebx
je 0x42c913
push dword [ebp - 0x70]
call esi
push dword [ebp - 0x78]
call esi
pop edi
mov ecx, dword [ebp + 0x3a4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0043b4a5
add ebp, 0x3a8
leave
ret 4
Function at 0x42d68d
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x410
lea ebp, [esp - 4]
mov eax, dword [0x506550]
xor eax, ebp
mov dword [ebp + 0x410], eax
push 0x2c
mov eax, 0x4c25ae
call fcn.0043c032
mov eax, dword [ebp + 0x41c]
xor ebx, ebx
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ebx
call fcn.0040db08
mov esi, 0x206
push esi
xor edi, edi
lea eax, [ebp + 2]
push ebx
inc edi
push eax
mov dword [ebp - 4], edi
mov word [ebp], bx
call fcn.0043b4c0
push esi
lea eax, [ebp + 0x20a]
push ebx
push eax
mov word [ebp + 0x208], bx
call fcn.0043b4c0
add esp, 0x18
lea ecx, [ebp - 0x38]
call fcn.0040dac0
test eax, eax
push 0x104
lea eax, [ebp + 0x208]
push eax
je 0x42d71b
lea ecx, [ebp - 0x38]
call fcn.0040dae9
jmp 0x42d721
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp + 0x208]
push eax
lea eax, [ebp]
push 0x4cc4d4
push eax
call fcn.0043c4d1
mov ecx, dword [ebp - 0x10]
add esp, 0xc
lea eax, [ebp]
push eax
call fcn.004015c0
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], bl
call fcn.0040d9e3
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.0043b4a5
add ebp, 0x414
leave
ret 4
Function at 0x430525
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0x24
call fcn.00431563
mov esi, eax
xor edi, edi
cmp esi, edi
pop ecx
je 0x430545
lea ecx, [esi + 8]
call fcn.0041c600
jmp 0x430547
xor esi, esi
push dword [ebp + 8]
lea ecx, [esi + 8]
call fcn.00401710
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x4304f6
push edi
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
mov ecx, esi
call fcn.0042f789
pop edi
pop esi
leave
ret 8

Function at 0x4306e4
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x506550]
xor eax, ebp
mov dword [ebp + 0x190], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x80]
push eax
xor edi, edi
mov esi, 0xf003f
push esi
push edi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
mov ebx, ecx
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x7c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x430797
push edi
lea eax, [ebp - 0x7c]
push eax
push edi
push esi
push edi
push edi
push edi
push str.WnIE
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x430797
push 0x206
lea eax, [ebp - 0x76]
push edi
push eax
mov word [ebp - 0x78], di
call fcn.0043b4c0
add esp, 0xc
cmp dword [ebx + 0x34], 8
jb 0x430768
mov ebx, dword [ebx + 0x20]
jmp 0x43076b
add ebx, 0x20
push ebx
lea eax, [ebp - 0x78]
push 0x4c704c
push eax
call fcn.0043c4d1
add esp, 0xc
push 0x104
lea eax, [ebp - 0x78]
push eax
push 1
push edi
push str.InstallPath
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp + 0x190]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043b4a5
add ebp, 0x194
leave
ret
Function at 0x4307d7
Capabilities:
Set registry value

Disassembly:
push 0x620
mov eax, 0x4c2b73
call fcn.0043c09b
xor edi, edi
inc edi
push 0x4dfbb4
lea ecx, [ebp + 0x24]
mov dword [ebp - 4], edi
call fcn.0040cf49
xor esi, esi
test eax, eax
jne 0x430810
push esi
push edi
lea ecx, [ebp + 8]
call fcn.004017c0
push esi
push edi
jmp 0x43091b
mov edi, 0x206
push edi
lea eax, [ebp - 0x626]
push esi
push eax
mov word [ebp - 0x628], si
call fcn.0043b4c0
push edi
lea eax, [ebp - 0x41e]
push esi
push eax
mov word [ebp - 0x420], si
call fcn.0043b4c0
mov eax, dword [ebp + 0x28]
add esp, 0x18
cmp dword [ebp + 0x3c], 8
jae 0x43084e
lea eax, [ebp + 0x28]
push eax
mov ebx, 0x4c704c
lea eax, [ebp - 0x420]
push ebx
push eax
call fcn.0043c4d1
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp dword [ebp + 0x20], 8
jae 0x430870
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x628]
push ebx
push eax
call fcn.0043c4d1
push edi
lea eax, [ebp - 0x216]
push esi
push eax
mov word [ebp - 0x218], si
call fcn.0043b4c0
lea eax, [ebp - 0x218]
push 0x4c6de0
push eax
call fcn.0043b68e
lea eax, [ebp - 0x218]
push str.WnIE
push eax
call fcn.0043b664
add esp, 0x28
push esi
lea eax, [ebp - 0x62c]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x430901
push 0x104
lea eax, [ebp - 0x420]
push eax
push 1
push esi
lea eax, [ebp - 0x628]
push eax
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push 1
lea ecx, [ebp + 8]
call fcn.004017c0
push esi
push 1
lea ecx, [ebp + 0x24]
call fcn.004017c0
call fcn.0043c11e
ret 0x38

Function at 0x430985
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x506550]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
push 0x206
lea eax, [ebp - 0x20a]
push esi
push eax
mov ebx, ecx
mov word [ebp - 0x20c], si
call fcn.0043b4c0
add esp, 0xc
push esi
push 0x26
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
lea esi, [ebx + 0x1c]
push eax
mov ecx, esi
call fcn.00401790
mov edi, 0x4dfb94
push edi
mov ecx, esi
call fcn.004036c0
push str.WnIE
mov ecx, esi
call fcn.004036c0
push edi
mov ecx, esi
call fcn.004036c0
push 0xffffffffffffffff
push 0
add ebx, 0x38
push esi
mov ecx, ebx
call fcn.00401d30
push str.Bin_
mov ecx, ebx
call fcn.004036c0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043b4a5
leave
ret
Function at 0x430c64
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x410
lea ebp, [esp - 4]
mov eax, dword [0x506550]
xor eax, ebp
mov dword [ebp + 0x410], eax
push 0x10
mov eax, 0x4c2bdf
call fcn.0043c032
mov ebx, dword [ebp + 0x41c]
xor esi, esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], esi
mov edi, 0x4dfbb4
push edi
lea ecx, [ebp + 0x420]
mov dword [ebp - 4], esi
call fcn.0040cf49
test eax, eax
jne 0x430ccb
push edi
mov ecx, ebx
call fcn.004015c0
push esi
push 1
lea ecx, [ebp + 0x420]
call fcn.004017c0
mov eax, ebx
jmp 0x430da6
push 0x206
lea eax, [ebp + 0x20a]
push esi
push eax
mov word [ebp + 0x208], si
call fcn.0043b4c0
mov eax, dword [ebp + 0x424]
add esp, 0xc
cmp dword [ebp + 0x438], 8
jae 0x430cfc
lea eax, [ebp + 0x424]
push eax
lea eax, [ebp + 0x208]
push 0x4c704c
push eax
call fcn.0043c4d1
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push 0xf003f
push esi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
call ebx
test eax, eax
je 0x430d3a
push edi
jmp 0x430d8d
lea eax, [ebp - 0x14]
push eax
push 0xf003f
push esi
push str.WnIE
push dword [ebp - 0x18]
call ebx
test eax, eax
jne 0x430d37
push 0x206
lea eax, [ebp + 2]
push esi
push eax
mov word [ebp], si
call fcn.0043b4c0
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp]
push eax
push esi
push esi
lea eax, [ebp + 0x208]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x1c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.004015c0
push esi
push 1
lea ecx, [ebp + 0x420]
call fcn.004017c0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.0043b4a5
add ebp, 0x414
leave
ret 0x20