joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d98a
Capabilities:
Log keystrokes

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [0x4eab70]
push esi
push edi
call ebp
mov esi, dword [esp + 0x18]
cmp eax, esi
je 0x42da3b
mov edi, dword [0x4eab9c]
push 0
push esi
call edi
mov ebx, eax
push 0
mov dword [esp + 0x14], ebx
call ebp
push eax
call edi
cmp eax, ebx
mov dword [esp + 0x18], eax
je 0x42da49
mov edi, dword [0x4eab74]
push 1
push eax
push ebx
call edi
mov ebx, dword [0x4eac7c]
push esi
call ebx
push esi
call dword [0x4eab7c]
push 0
push dword [esp + 0x1c]
push dword [esp + 0x18]
call edi
call ebp
cmp eax, esi
je 0x42da36
mov edi, dword [0x4eab80]
xor ebp, ebp
push ebp
lea eax, [esp + 0x1c]
push eax
push ebp
push 0x2000
call edi
push 2
push ebp
push ebp
mov ebp, 0x2001
push ebp
call edi
push esi
call ebx
push esi
call dword [0x4eab7c]
push esi
call dword [0x4eab84]
push 2
lea eax, [esp + 0x1c]
push eax
push 0
push ebp
call edi
jmp 0x42da49
push esi
call ebx
jmp 0x42da42
push esi
call dword [0x4eac7c]
push esi
call dword [0x4eab84]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x42da4f
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [sym.imp.XLUE.dll__XLUE_GetHostWndByID_4]
push ebp
push esi
push edi
push str.Thunder.MainFrame
call ebx
test eax, eax
je 0x42db7a
mov esi, dword [sym.imp.XLUE.dll__XLUE_GetHostWndWindowHandle_4]
push eax
call esi
mov ebp, eax
test ebp, ebp
je 0x42db7a
push ebp
call dword [0x4eab68]
test eax, eax
je 0x42dad3
push 1
push str.ConfigFloatPanel_Visiable
push str.ConfigFloatPanel
call fcn.0040fe81
mov ecx, eax
call fcn.0042d699
cmp eax, 1
mov edi, dword [0x4eabb4]
jne 0x42dab8
push str.window.floatpanel
call ebx
push 0
push eax
call esi
push eax
call edi
call fcn.004274df
mov ecx, eax
call fcn.0042dd51
push 2
push ebp
call edi
push 0
push ebp
call edi
jmp 0x42db7a
call dword [0x4eab70]
cmp eax, ebp
je 0x42db7a
push 1
push str.ConfigFloatPanel_Visiable
push str.ConfigFloatPanel
call fcn.0040fe81
mov ecx, eax
call fcn.0042d699
cmp eax, 1
mov edi, dword [0x4eabb4]
jne 0x42db30
push str.window.floatpanel
call ebx
push eax
call esi
mov esi, eax
push esi
call dword [0x4eabc0]
test eax, eax
je 0x42db20
push 9
push esi
call edi
push esi
call dword [0x4eab68]
test eax, eax
jne 0x42db30
push 5
push esi
call edi
call fcn.004274df
mov ecx, eax
call fcn.0042dd37
push ebp
call dword [0x4eabc0]
test eax, eax
je 0x42db4c
push 9
push ebp
call edi
push ebp
call dword [0x4eab68]
test eax, eax
jne 0x42db5c
push 5
push ebp
call edi
push ebp
call dword [0x4eab6c]
mov esi, eax
push esi
call dword [0x4eac7c]
push esi
call dword [0x4eab7c]
push esi
call fcn.0042d98a
pop ecx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
Function at 0x42f28d
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x4dd77c
call fcn.004d0500
sub esp, 0x20
mov ecx, dword [ebp + 0xc]
call fcn.0040287c
cmp dword [ebp + 8], 0
je 0x42f30e
push dword [ebp + 8]
call dword [0x4ea7b4]
test eax, eax
pop ecx
je 0x42f30e
and dword [ebp - 0x10], 0
push esi
push edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [0x4eaa50]
xor esi, esi
cmp dword [ebp - 0x10], esi
mov edi, eax
jle 0x42f301
push dword [edi + esi*4]
lea ecx, [ebp - 0x2c]
call dword [0x4ea6a8]
mov ecx, dword [ebp + 0xc]
and dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
call fcn.00402b27
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call dword [0x4ea4f8]
inc esi
cmp esi, dword [ebp - 0x10]
jl 0x42f2d2
push edi
call dword [0x4ea230]
pop edi
xor eax, eax
pop esi
jmp 0x42f311
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 8
Function at 0x42f7fc
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4dd803
call fcn.004d0500
sub esp, 0x4c
mov eax, dword [0x52d320]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
push 0
mov dword [ebp - 0x38], ecx
push 0x3a
mov ecx, esi
mov dword [ebp - 0x34], eax
call dword [0x4ea3f0]
cmp eax, 0xffffffff
jne 0x42f83e
xor eax, eax
jmp 0x42f9b2
push ebx
push edi
push dword [esi + 0x14]
inc eax
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call dword [0x4ea6d8]
mov ebx, dword [0x4ea7b4]
and dword [ebp - 4], 0
mov edi, str._AgentStreamFile
push edi
call ebx
pop ecx
push eax
push edi
mov ecx, esi
call dword [0x4ea6a4]
mov edi, dword [0x4ea7d4]
push eax
call edi
add esp, 0xc
test eax, eax
jne 0x42f944
lea ecx, [ebp - 0x2c]
call dword [0x4ea6a4]
push eax
call dword [0x4eaadc]
test eax, eax
je 0x42f99f
mov ecx, dword [ebp - 0x30]
push str.StreamMediaTask
call dword [0x4ea730]
xor esi, esi
mov dword [ebp - 0x30], esi
push esi
push esi
push 0x80
push 3
push 1
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call dword [0x4ea6a4]
push eax
lea ecx, [ebp - 0x30]
call fcn.004015ee
cmp eax, esi
je 0x42f8e2
cmp dword [ebp - 0x30], esi
je 0x42f9a1
push dword [ebp - 0x30]
jmp 0x42f93c
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x50], esi
mov edi, dword [ebp - 0x30]
push 4
push 2
push esi
push esi
push esi
push edi
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.00401624
cmp eax, esi
jne 0x42f92f
cmp dword [ebp - 0x58], esi
je 0x42f92f
push dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
push dword [ebp - 0x58]
call fcn.0042f4bf
lea ecx, [ebp - 0x58]
mov ebx, eax
call fcn.004016d1
cmp edi, esi
je 0x42f92b
push edi
call dword [0x4ea2b4]
mov esi, ebx
jmp 0x42f9a1
lea ecx, [ebp - 0x58]
call fcn.004016d1
cmp edi, esi
je 0x42f9a1
push edi
call dword [0x4ea2b4]
jmp 0x42f9a1
push str._AgentStreamShareMem
call ebx
pop ecx
push eax
push str._AgentStreamShareMem
mov ecx, esi
call dword [0x4ea6a4]
push eax
call edi
add esp, 0xc
test eax, eax
jne 0x42f99f
mov ecx, dword [ebp - 0x30]
push str.StreamMediaTask
call dword [0x4ea730]
lea ecx, [ebp - 0x2c]
call dword [0x4ea6a4]
push eax
call dword [0x4ea7d8]
mov esi, eax
test esi, esi
pop ecx
je 0x42f99f
mov ecx, dword [ebp - 0x34]
push esi
call dword [0x4ea730]
push esi
call fcn.004d04f4
xor esi, esi
pop ecx
inc esi
jmp 0x42f9a1
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call dword [0x4ea4f8]
pop edi
mov eax, esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
pop esi
call fcn.004d0557
leave
ret 0xc
Function at 0x430142
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4dd8a0
call fcn.004d0500
push ecx
mov eax, dword [0x4eac50]
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi + 4], edi
mov dword [esi + 0x14], edi
mov dword [ebp - 0x10], esi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], eax
lea ecx, [esi + 0x24]
mov dword [ebp - 4], edi
mov dword [esi], 0x4f2f64
call fcn.0042d8c6
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.0042d8c6
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 2
call fcn.0042ec90
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x68], edi
lea ecx, [esi + 0x84]
mov byte [ebp - 4], 5
mov dword [esi + 0x80], edi
call dword [0x4ea6b0]
lea eax, [esi + 0xa0]
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
lea ecx, [esi + 0xb0]
mov byte [ebp - 4], 7
call dword [0x4ea6b0]
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x435315
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4de15b
call fcn.004d0500
sub esp, 0x60
mov eax, dword [0x52d320]
xor eax, ebp
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x50], ecx
push edi
mov edi, dword [ebp + 0x14]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x4c], eax
call dword [0x4ea6b0]
xor ebx, ebx
cmp dword [esi + 0x14], ebx
mov dword [ebp - 4], ebx
je 0x43538b
push ebx
mov ecx, esi
call dword [0x4ea418]
cmp word [eax], 0x2e
je 0x43538b
push esi
lea eax, [ebp - 0x6c]
push 0x2e
push eax
call fcn.004177b2
add esp, 0xc
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call dword [0x4ea4e8]
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], bl
call dword [0x4ea4f8]
jmp 0x435395
push esi
lea ecx, [ebp - 0x2c]
call dword [0x4ea4e8]
mov esi, dword [ebp - 0x50]
push edi
push dword [ebp - 0x4c]
lea eax, [ebp - 0x2c]
push dword [ebp + 0xc]
mov ecx, esi
push eax
call fcn.00433e91
cmp eax, ebx
je 0x435413
lea ecx, [ebp - 0x48]
call dword [0x4ea6b0]
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.004338cb
cmp eax, ebx
jne 0x435424
cmp dword [ebp - 0x34], ebx
je 0x435424
lea ecx, [ebp - 0x48]
call dword [0x4ea6a4]
push eax
call dword [0x4eaadc]
test eax, eax
je 0x435424
lea ecx, [ebp - 0x48]
call dword [0x4ea6a4]
push eax
push edi
push 2
push dword [ebp + 0xc]
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.0043501e
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], bl
call dword [0x4ea4f8]
mov ebx, reloc.libexpat.dll_Ordinal_10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call dword [0x4ea4f8]
mov eax, ebx
jmp 0x435454
push ebx
push edi
push 1
push dword [ebp + 0xc]
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.0043501e
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], bl
call dword [0x4ea4f8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call dword [0x4ea4f8]
mov eax, reloc.libexpat.dll_Ordinal_10
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.004d0557
leave
ret 0x10

Function at 0x435a03
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x52d320]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, ebp
mov esi, 0x2b4
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2b8]
push 0
push eax
call fcn.004d05b6
add esp, 0xc
cmp dword [ebp + 0xc], 0
mov ecx, edi
lea eax, [ebp - 0x2b8]
je 0x435a4b
push 0x4510
jmp 0x435a50
push 0x4511
push esi
push eax
push 0x80
call dword [0x4ea6a4]
push eax
call dword [0x4eaa40]
test eax, eax
jne 0x435a6b
inc eax
jmp 0x435a75
mov eax, dword [ebp - 0x2b8]
mov dword [ebx], eax
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d0557
leave
ret 0xc
Function at 0x441f15
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
shl eax, 1
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [0x4ea020]
test eax, eax
jne 0x441f73
cmp dword [ebp + 0x10], 1
je 0x441f51
cmp dword [ebp + 0x10], 2
jne 0x441f68
test edi, edi
mov eax, dword [ebp - 4]
je 0x441f6d
test al, 1
jne 0x441f68
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x441f6d
push 0xd
pop eax
jmp 0x441f73
shr eax, 1
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc

Function at 0x441f79
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [0x4ea014]
ret 8

Function at 0x441f93
Capabilities:
Set registry value

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, ecx
call dword [0x4ea310]
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0x10]
push dword [esp + 0x18]
push 0
push dword [esp + 0x18]
push dword [esi]
call dword [0x4ea014]
pop esi
ret 0xc
Function at 0x443353
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4deb8e
call fcn.004d0500
sub esp, 0x20
mov eax, dword [0x52d320]
xor eax, ebp
push esi
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x10], eax
call dword [0x4ea6b0]
and dword [ebp - 4], 0
test esi, esi
je 0x443394
lea eax, [ebp - 0x2c]
push eax
push esi
call fcn.004d05da
pop ecx
push eax
push esi
call fcn.0044f5c2
add esp, 0xc
lea ecx, [ebp - 0x2c]
call dword [0x4ea6a4]
push eax
call dword [0x4eaadc]
xor esi, esi
test eax, eax
je 0x4433ab
inc esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call dword [0x4ea4f8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004d0557
leave
ret 4

Function at 0x443620
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x52d320]
and word [ebp - 0x20c], 0
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
push 1
stosw word es:[edi], ax
push 0x10
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [0x4eaa5c]
test eax, eax
je 0x443697
lea eax, [ebp - 0x20c]
push eax
call dword [0x4eaac4]
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [0x4ea7b4]
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0044f54c
xor eax, eax
add esp, 0xc
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004d0557
leave
ret 4

Function at 0x4436a7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x52d320]
and word [ebp - 0x20c], 0
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
push 1
stosw word es:[edi], ax
push 5
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [0x4eaa5c]
test eax, eax
je 0x44371e
lea eax, [ebp - 0x20c]
push eax
call dword [0x4eaac4]
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [0x4ea7b4]
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0044f54c
xor eax, eax
add esp, 0xc
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004d0557
leave
ret 4

Function at 0x44372e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x52d320]
and word [ebp - 0x20c], 0
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
push 1
stosw word es:[edi], ax
push 0x23
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [0x4eaa5c]
test eax, eax
je 0x4437a5
lea eax, [ebp - 0x20c]
push eax
call dword [0x4eaac4]
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [0x4ea7b4]
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0044f54c
xor eax, eax
add esp, 0xc
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004d0557
leave
ret 4
Function at 0x444e04
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x4ded6e
call fcn.004d0500
sub esp, 0x484
mov eax, dword [0x52d320]
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
xor eax, ebp
push 0x4eb79e
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x490], ecx
call dword [0x4ea768]
xor edi, edi
mov dword [ebx], edi
call dword [0x4eab70]
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push eax
mov dword [ebp - 0x464], eax
call dword [0x4eac04]
lea eax, [ebp - 0x218]
push str.Program_Manager
push eax
call dword [0x4ea7a8]
test eax, eax
pop ecx
pop ecx
jne 0x444e79
mov dword [ebx], edi
jmp 0x445007
cmp dword [ebp - 0x464], edi
je 0x445007
push esi
mov esi, dword [0x4eabb0]
push edi
call esi
push 1
mov dword [ebp - 0x468], eax
call esi
cmp dword [ebp - 0x468], edi
mov dword [ebp - 0x48c], eax
jle 0x445006
cmp eax, edi
jle 0x445006
lea eax, [ebp - 0x478]
push eax
push dword [ebp - 0x464]
mov dword [ebp - 0x478], edi
mov dword [ebp - 0x474], edi
mov dword [ebp - 0x470], edi
mov dword [ebp - 0x46c], edi
call dword [0x4eab28]
test eax, eax
je 0x445006
mov eax, dword [ebp - 0x478]
mov esi, dword [0x4eabb8]
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x488], eax
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x484], eax
lea eax, [ebp - 0x480]
push eax
push dword [ebp - 0x464]
call esi
test eax, eax
je 0x445006
lea eax, [ebp - 0x488]
push eax
push dword [ebp - 0x464]
call esi
test eax, eax
je 0x445006
mov eax, dword [ebp - 0x480]
cmp eax, edi
mov ecx, dword [ebp - 0x47c]
mov edx, dword [ebp - 0x488]
mov esi, dword [ebp - 0x484]
mov dword [ebp - 0x478], eax
mov dword [ebp - 0x474], ecx
mov dword [ebp - 0x470], edx
mov dword [ebp - 0x46c], esi
jg 0x444f97
cmp ecx, edi
jg 0x444f97
cmp edx, dword [ebp - 0x468]
jl 0x444f97
cmp esi, dword [ebp - 0x48c]
jl 0x444f97
xor eax, eax
inc eax
jmp 0x444f99
xor eax, eax
mov dword [ebx], eax
lea eax, [ebp - 0x468]
push eax
push dword [ebp - 0x464]
call dword [0x4eab9c]
cmp dword [ebp - 0x468], edi
je 0x445006
push edi
push 2
call fcn.004d009c
mov esi, eax
cmp esi, 0xffffffff
je 0x445006
lea eax, [ebp - 0x460]
push eax
push esi
mov dword [ebp - 0x460], 0x22c
call fcn.004d0096
cmp eax, edi
je 0x444fff
mov eax, dword [ebp - 0x468]
cmp eax, dword [ebp - 0x458]
je 0x445021
lea eax, [ebp - 0x460]
push eax
push esi
call fcn.004d0090
test eax, eax
jne 0x444fe0
push esi
call dword [0x4ea2b4]
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop edi
xor ecx, ebp
pop ebx
call fcn.004d0557
leave
ret 8
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.004522b2
pop ecx
pop ecx
push dword [ebp - 0x490]
lea ecx, [ebp - 0x234]
push dword [ebp - 0x220]
mov dword [ebp - 4], edi
call dword [0x4ea6a4]
push eax
call fcn.0044f54c
add esp, 0xc
push esi
call dword [0x4ea2b4]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call dword [0x4ea4f8]
jmp 0x445006
Function at 0x445464
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x52d320]
xor eax, ebp
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
push eax
xor eax, eax
push eax
push eax
push 0x8037
push eax
call dword [0x4eaa48]
test eax, eax
jl 0x4454b7
lea eax, [ebp - 0x210]
push esi
push eax
call dword [0x4ea7b4]
pop ecx
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.0044f54c
add esp, 0xc
jmp 0x4454c4
push 0x4eb79e
mov ecx, esi
call dword [0x4ea768]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004d0557
leave
ret 4

Function at 0x4455e4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.00445569
test eax, eax
je 0x44565b
and dword [ebp - 8], 0
push esi
push 4
pop esi
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.libexpat.dll_Ordinal_2
mov dword [ebp - 0xc], esi
call dword [0x4ea024]
test eax, eax
mov dword [ebp - 0x10], esi
pop esi
jne 0x44565b
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.EnableLUA
push dword [ebp - 4]
call dword [0x4ea020]
test eax, eax
jne 0x445652
cmp dword [ebp - 8], 1
jne 0x445652
push dword [ebp - 4]
call dword [0x4ea018]
xor eax, eax
inc eax
leave
ret
push dword [ebp - 4]
call dword [0x4ea018]
xor eax, eax
leave
ret
Function at 0x445f0b
Capabilities:
Create shortcut via ishelllink
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1a0]
sub esp, 0x220
mov eax, dword [0x52d320]
xor eax, ebp
mov dword [ebp + 0x19c], eax
mov eax, dword [ebp + 0x1a8]
push ebx
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x1ac]
push esi
push edi
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x1b4]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x1b8]
push 0x7f
pop ecx
mov dword [ebp - 0x74], eax
xor ebx, ebx
xor eax, eax
mov word [ebp - 0x64], bx
lea edi, [ebp - 0x62]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x68]
push eax
push 0x503010
push 1
push ebx
push 0x503040
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x70], ebx
call dword [0x4eb088]
mov esi, eax
cmp esi, ebx
jl 0x446076
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
lea edx, [ebp - 0x70]
push edx
push 0x503090
push eax
call dword [ecx]
mov esi, eax
cmp esi, ebx
jl 0x446076
mov eax, dword [ebp - 0x68]
push dword [ebp - 0x80]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov esi, eax
cmp esi, ebx
jl 0x446076
cmp dword [ebp - 0x74], ebx
je 0x445fd2
mov eax, dword [ebp - 0x68]
push dword [ebp - 0x74]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
mov esi, eax
cmp esi, ebx
jl 0x446076
cmp dword [ebp - 0x78], ebx
je 0x445fee
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
push ebx
push dword [ebp - 0x78]
push eax
call dword [ecx + 0x44]
mov esi, eax
cmp esi, ebx
jl 0x446076
mov eax, dword [ebp + 0x1b0]
sub eax, ebx
mov esi, dword [0x4ea2a8]
je 0x44602d
dec eax
je 0x44600c
dec eax
jne 0x446051
lea eax, [ebp - 0x6c]
push eax
push 0x19
jmp 0x446032
lea eax, [ebp - 0x6c]
push eax
push 0x1a
push ebx
call dword [0x4eaa80]
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x6c]
call dword [0x4eaa68]
push str.MicrosoftInternet_ExplorerQuick_Launch_
jmp 0x44604b
lea eax, [ebp - 0x6c]
push eax
push ebx
push ebx
call dword [0x4eaa80]
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x6c]
call dword [0x4eaa68]
push 0x4eb7e4
lea eax, [ebp - 0x64]
push eax
call esi
push dword [ebp - 0x7c]
lea eax, [ebp - 0x64]
push eax
call esi
push 0x4f569c
lea eax, [ebp - 0x64]
push eax
call esi
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
push 1
lea edx, [ebp - 0x64]
push edx
push eax
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [ebp - 0x70]
cmp eax, ebx
je 0x446083
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x68]
cmp eax, ebx
je 0x446090
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp + 0x19c]
xor eax, eax
cmp esi, ebx
pop edi
setge al
pop esi
xor ecx, ebp
pop ebx
call fcn.004d0557
add ebp, 0x1a0
leave
ret 0x14
Function at 0x4460b1
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x388]
sub esp, 0x408
mov eax, dword [0x52d320]
xor eax, ebp
mov dword [ebp + 0x384], eax
mov eax, dword [ebp + 0x394]
push esi
xor ecx, ecx
sub eax, ecx
push edi
mov edi, dword [ebp + 0x390]
je 0x446113
dec eax
je 0x4460f2
dec eax
je 0x4460ea
xor al, al
jmp 0x44615e
lea eax, [ebp - 0x80]
push eax
push 0x19
jmp 0x446118
lea eax, [ebp - 0x80]
push eax
push 0x1a
push ecx
call dword [0x4eaa80]
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
call dword [0x4eaa68]
push str.MicrosoftInternet_ExplorerQuick_Launch_
jmp 0x446131
lea eax, [ebp - 0x80]
push eax
push ecx
push ecx
call dword [0x4eaa80]
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
call dword [0x4eaa68]
push 0x4eb7e4
mov esi, dword [0x4ea2a8]
lea eax, [ebp - 0x7c]
push eax
call esi
push edi
lea eax, [ebp - 0x7c]
push eax
call esi
push 0x4f569c
lea eax, [ebp - 0x7c]
push eax
call esi
lea eax, [ebp - 0x7c]
push eax
call dword [0x4ea364]
test eax, eax
setne al
mov ecx, dword [ebp + 0x384]
pop edi
xor ecx, ebp
pop esi
call fcn.004d0557
add ebp, 0x388
leave
ret 8