joyce8/EMBER2024-capa huggingface dataset:
Function at 0x20012471
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
push ebx
push edi
xor ebx, ebx
push 0x206
lea eax, [ebp - 0x212]
push ebx
push eax
mov dword [ebp - 0xc], ebx
mov word [ebp - 0x214], bx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor eax, eax
cmp dword [ebp + 8], ebx
lea edi, [ebp - 6]
mov word [ebp - 8], bx
stosd dword es:[edi], eax
mov word [ebp - 6], 0x3a
je 0x200125ae
push esi
mov eax, dword [ebp + 8]
cmp word [eax], bx
je 0x200125ad
push 0x7c
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edi, eax
cmp edi, ebx
je 0x200124e9
mov word [edi], bx
inc edi
inc edi
cmp word [ebp - 0x214], bx
lea esi, [ebp - 0x214]
je 0x2001259d
movzx eax, word [esi]
push eax
call fcn.20004235
mov word [ebp - 8], ax
mov eax, dword [ebp - 8]
add eax, 0xffffffbd
cmp ax, 0x14
pop ecx
ja 0x20012589
push esi
call fcn.20004e0e
cmp eax, 3
pop ecx
jne 0x20012589
push dword [ebp - 8]
call fcn.20004699
test eax, eax
pop ecx
je 0x20012589
push 0x20002e14
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x624]
push 0x20002e04
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x624]
push eax
call fcn.20004465
add esp, 0x18
test eax, eax
je 0x20012589
lea eax, [ebp - 0x624]
push eax
call fcn.20012401
test eax, eax
pop ecx
je 0x20012589
push dword [ebp + 0xc]
lea eax, [ebp - 0x624]
push eax
call fcn.20012120
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
jg 0x200125ad
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
cmp word [esi], bx
jne 0x200124fc
cmp dword [ebp - 0xc], ebx
jg 0x200125ad
cmp edi, ebx
mov dword [ebp + 8], edi
jne 0x200124c9
pop esi
mov eax, dword [ebp - 0xc]
pop edi
pop ebx
leave
ret
Function at 0x20012acc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
and word [ebp - 0x20c], 0
push esi
push edi
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
xor edi, edi
cmp word [ebp - 0x20c], di
lea esi, [ebp - 0x20c]
je 0x20012b72
mov eax, dword [ebp + 0xc]
add eax, 0x10
mov dword [ebp - 4], eax
push esi
call fcn.200049eb
cmp eax, dword [ebp - 4]
pop ecx
jbe 0x20012b61
push esi
call fcn.20004e0e
sub eax, 3
pop ecx
je 0x20012b55
sub eax, 0xfffe
je 0x20012b50
dec eax
jne 0x20012b61
movzx edi, word [esi]
jmp 0x20012b61
movzx eax, word [esi]
cmp ax, word [ebp + 8]
movzx edi, ax
jae 0x20012b72
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
cmp word [esi], 0
jne 0x20012b2e
mov ax, di
pop edi
pop esi
leave
ret
Function at 0x20012b79
Capabilities:
Get disk information
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x648
and dword [ebp - 0xc], 0
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x20
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x20012bd9
and word [ebx], 0
inc ebx
inc ebx
push ebx
call fcn.200042be
pop ecx
push 0x20
push ebx
mov dword [ebp - 0xc], eax
call edi
test eax, eax
je 0x20012bcb
and word [eax], 0
add eax, 2
push eax
call fcn.200042be
pop ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jae 0x20012bd9
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
call fcn.2000c589
cmp eax, dword [ebp - 4]
jae 0x20012d6e
xor eax, eax
lea edi, [ebp - 0x12]
stosd dword es:[edi], eax
stosw word es:[edi], ax
movzx eax, word [esi]
push eax
call fcn.20004235
push dword [ebp - 4]
mov word [ebp - 0x14], ax
mov word [ebp - 0x12], 0x3a
push dword [ebp - 0x14]
call fcn.20012acc
add esp, 0xc
mov word [ebp - 0x14], ax
mov word [esi], ax
push 0x104
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov word [ebp - 0x1c], ax
mov eax, dword [ebp - 0x1c]
add eax, 2
mov word [ebp - 0x1a], ax
lea eax, [ebp - 0x440]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
shl eax, 0x14
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
xor ebx, ebx
shl eax, 0x14
push 0x20002e94
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ebx
call fcn.2000fbb7
push ebx
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.20005c53
add esp, 0x14
cmp eax, ebx
mov dword [ebp - 0x20], eax
jne 0x20012d69
push 0x206
lea eax, [ebp - 0x236]
push ebx
push eax
mov dword [ebp - 8], 0x208
mov word [ebp - 0x238], bx
call sub.MSVCRT.dll_memset
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push 0x20002e70
push 0x20002ad8
lea eax, [ebp - 0x238]
push 0x200029c0
push eax
call edi
add esp, 0x1c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x648]
push eax
push ebx
push 0x20002e58
lea eax, [ebp - 0x238]
push eax
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x20012d15
xor eax, eax
jmp 0x20012d1b
mov eax, dword [ebp - 8]
shr eax, 1
dec eax
push dword [ebp - 4]
mov dword [ebp - 8], eax
push dword [ebp - 0xc]
lea eax, [ebp + eax*2 - 0x648]
push esi
push 0x20002e44
push eax
call edi
mov ecx, dword [ebp - 8]
lea eax, [ecx + eax + 1]
add esp, 0x14
mov dword [ebp - 8], eax
add eax, eax
and word [ebp + eax - 0x648], 0
push eax
lea eax, [ebp - 0x648]
push eax
push 7
push 0x20002e58
lea eax, [ebp - 0x238]
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov eax, dword [ebp - 0x20]
jmp 0x20012d70
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x20012db2
Capabilities:
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
xor ebx, ebx
push 0xf003f
push ebx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x20012e2b
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp word [eax], 0x21
sete cl
cmp ecx, ebx
mov dword [ebp - 8], ecx
je 0x20012de7
inc eax
inc eax
push esi
push edi
push 0x30
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
cmp esi, ebx
je 0x20012e24
cmp dword [ebp - 8], ebx
je 0x20012e15
lea eax, [ebp - 0x28]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x20012e1e
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push esi
mov dword [ebp - 4], eax
call edi
push dword [ebp - 0xc]
call edi
pop edi
pop esi
xor eax, eax
cmp dword [ebp - 4], ebx
pop ebx
sete al
leave
ret

Function at 0x20012f35
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x20
push 0x800
push 0x10
push dword [ebp + 8]
call fcn.20012e36
add esp, 0x10
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 4
push 0x20002f20
push 0x20002ed8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0x20002ec8
call fcn.20012db2
pop ecx
leave
ret

Function at 0x20012fbc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x20002fec
push 0x20002f78
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x20013040
push 0x20002f5c
push 0x20002f48
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x20013040
mov cl, byte [ebp + 0xc]
and cl, 1
movzx cx, cl
shl cx, 2
mov word [ebp - 0x18], cx
mov ecx, dword [ebp - 0xc]
mov edx, ecx
shr edx, 0x10
mov word [ebp - 0x1c], dx
movzx dx, byte [ebp - 0xe]
mov word [ebp - 0x12], cx
lea ecx, [ebp - 0x1c]
push ecx
mov word [ebp - 0xe], dx
call eax
mov al, 1
leave
ret
xor al, al
leave
ret
Function at 0x20013044
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push edi
push 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
push 0x20002fec
push 0x200031b4
mov edi, reloc.OLEAUT32.dll_SysReAllocString
xor ebx, ebx
push edi
mov dword [ebp - 0x18], ebx
call esi
test eax, eax
je 0x20013086
mov dword [ebp - 0x18], ebx
push 0xf0000000
push 1
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x1c], 0x10
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x200130d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x200130d7
push 8
push 1
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x200130d7
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x200131f2
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push 0x8003
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 4
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
call ebx
push 0
push 4
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x10]
call ebx
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x30]
push eax
push 2
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
mov ebx, 0x200031a4
push ebx
push 0x20003160
push edi
mov dword [ebp - 8], 3
mov dword [ebp - 4], 1
call esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x20003110
push edi
mov dword [ebp - 8], 3
mov dword [ebp - 4], 1
call esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x20003160
mov ebx, SysReAllocString
push ebx
mov dword [ebp - 8], 3
mov dword [ebp - 4], 1
call esi
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], 3
push 0x200030f8
push 0x20003098
push edi
call esi
and dword [ebp - 0xc], 0
push 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x20003064
push 0x20002ff8
push ebx
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x2001323a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
push edi
mov esi, 0x206
xor edi, edi
push esi
lea eax, [ebp - 0x40e]
push edi
push eax
mov word [ebp - 0x410], di
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x206]
push edi
push eax
mov word [ebp - 0x208], di
call sub.MSVCRT.dll_memset
add esp, 0x18
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [ebp + 0xc], edi
je 0x2001329f
lea eax, [ebp - 0x208]
push eax
call fcn.2000c426
pop ecx
mov esi, eax
jmp 0x200132a5
lea esi, [ebp - 0x208]
push 0x104
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x20003200
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x410]
push esi
push eax
call fcn.2000c3c4
pop ecx
pop ecx
pop edi
pop esi
leave
ret

Function at 0x200136fa
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi]
push edi
xor edi, edi
inc edi
test eax, eax
jne 0x2001371c
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test eax, eax
mov dword [esi], eax
je 0x20013729
and eax, 0xffffffd8
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edi, eax
mov eax, edi
pop edi
pop esi
ret

Function at 0x20013746
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x660
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x660]
push 0x200029cc
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x660]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
test edi, edi
je 0x2001383f
cmp edi, 0xffffffff
je 0x2001383f
push ebx
lea eax, [ebp - 0x458]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
and word [ebp - 0x208], 0
push 0x206
mov ebx, eax
lea eax, [ebp - 0x206]
push 0
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x42c]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push 0x200029c0
push eax
call esi
add esp, 0x1c
test byte [ebp - 0x458], 0x10
je 0x2001381c
lea eax, [ebp - 0x42c]
push eax
call fcn.20007e6f
test eax, eax
pop ecx
jne 0x20013836
lea eax, [ebp - 0x208]
push eax
call fcn.20013746
lea eax, [ebp - 0x208]
push eax
call fcn.2001372e
pop ecx
pop ecx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x20013836
lea eax, [ebp - 0x208]
push eax
call fcn.2001372e
pop ecx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test ebx, ebx
jne 0x20013793
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
leave
ret
Function at 0x20013853
Capabilities:
Copy file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x874
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x874]
push 0x200029cc
push eax
mov dword [ebp - 4], 1
call esi
add esp, 0xc
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x874]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
test eax, eax
mov dword [ebp - 8], eax
je 0x200139a2
cmp eax, 0xffffffff
je 0x200139a2
push ebx
push edi
mov ebx, 0x206
mov edi, 0x200029c0
lea eax, [ebp - 0x464]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
and word [ebp - 0x66c], 0
push ebx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x66a]
push 0
push eax
call sub.MSVCRT.dll_memset
and word [ebp - 0x214], 0
push ebx
lea eax, [ebp - 0x212]
push 0
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x438]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x66c]
push edi
push eax
call esi
lea eax, [ebp - 0x438]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x214]
push edi
push eax
call esi
add esp, 0x38
test byte [ebp - 0x464], 0x10
je 0x2001395c
lea eax, [ebp - 0x438]
push eax
call fcn.20007e6f
test eax, eax
pop ecx
jne 0x20013996
lea eax, [ebp - 0x214]
push eax
call fcn.200044b5
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x66c]
push eax
call fcn.20013853
add esp, 0xc
jmp 0x2001397f
lea eax, [ebp - 0x214]
push eax
call fcn.200044b5
pop ecx
push 1
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x66c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x20013992
cmp dword [ebp - 4], 0
je 0x20013992
mov dword [ebp - 4], 1
jmp 0x20013996
and dword [ebp - 4], 0
cmp dword [ebp - 0xc], 0
jne 0x200138b2
pop edi
pop ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 4]
pop esi
leave
ret
Function at 0x20013e5a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
xor edi, edi
mov esi, 0x206
push esi
lea eax, [ebp - 0x20e]
push edi
push eax
mov word [ebx], di
mov word [ebp - 0x210], di
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 8]
push eax
push 0x208
lea eax, [ebp - 0x210]
push eax
push edi
push 9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
test eax, eax
je 0x20013f2a
push esi
lea eax, [ebp - 0x416]
push edi
push eax
mov word [ebp - 0x418], di
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x210]
push eax
push 0x20003288
lea eax, [ebp - 0x418]
push 0x20002b80
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 4]
push eax
push 0x20003264
lea eax, [ebp - 0x418]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 1
mov dword [ebp + 0x10], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x20013f2a
lea eax, [ebp - 0x210]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x200147c7
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x29c
push ebx
push esi
push edi
push 0x2c
push 6
push dword [ebp + 8]
lea eax, [ebp - 0x94]
push eax
mov dword [ebp - 0x14], 1
call fcn.2000c4a6
add esp, 0x10
push 0x10
pop ecx
mov esi, eax
lea edi, [ebp - 0x54]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x50]
mov esi, dword [ebp - 0x54]
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 8], edi
jne 0x20014811
push 3
pop eax
jmp 0x20014976
cmp dword [ebp - 0x48], ebx
mov dword [ebp - 0x10], ebx
je 0x20014839
push 0x23
push ebx
push dword [ebp - 0x48]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
je 0x20014839
mov word [eax], bx
add eax, 2
push eax
call fcn.200042be
pop ecx
mov dword [ebp - 0x10], eax
push ebx
lea eax, [ebp - 0x29c]
push eax
push 0x104
push ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
je 0x2001485e
lea eax, [ebp - 0x29c]
mov dword [ebp - 8], eax
jmp 0x20014869
push edi
call fcn.2000448d
test eax, eax
pop ecx
je 0x20014809
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x2001496d
lea eax, [ebp - 4]
push eax
push 0x20004110
xor edi, edi
inc edi
push edi
push ebx
push 0x20004120
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x2001496d
movzx eax, word [esi]
cmp ax, 0x21
jne 0x200148a6
xor edi, edi
jmp 0x200148af
cmp ax, 0x5f
jne 0x200148b3
push 7
pop edi
inc esi
inc esi
jmp 0x20014899
push 0x20003494
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
call fcn.200044b5
mov eax, dword [ebp - 4]
pop ecx
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x3c]
mov eax, dword [ebp - 4]
push dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp - 4]
push dword [ebp - 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
push dword [ebp - 0x10]
mov eax, dword [ebp - 4]
push dword [ebp - 0x48]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp - 4]
push dword [ebp - 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov edi, dword [ebp - 0x40]
cmp edi, ebx
je 0x2001491d
cmp word [edi], bx
je 0x2001491d
push edi
call fcn.2000448d
test eax, eax
pop ecx
je 0x2001491d
push edi
jmp 0x2001492e
push dword [ebp - 8]
call fcn.20004446
cmp eax, dword [ebp - 8]
pop ecx
je 0x20014937
push dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0xc]
push edx
push 0x20004140
push eax
call dword [ecx]
test eax, eax
jne 0x20014964
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push 1
push esi
push eax
call dword [ecx + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x2001497b
Capabilities:
Set environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x120
push esi
push edi
push 0x2c
push 2
push dword [ebp + 0x7c]
lea eax, [ebp - 0xac]
push eax
call fcn.2000c4a6
add esp, 0x10
push 0x10
mov esi, eax
pop ecx
lea edi, [ebp + 0x34]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0x34]
xor eax, eax
cmp ecx, eax
je 0x200149b6
cmp word [ecx], ax
jne 0x200149ca
mov edx, dword [ebp + 0x38]
cmp edx, eax
je 0x20014a5d
cmp word [edx], ax
je 0x20014a5d
cmp ecx, eax
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
je 0x20014a1a
cmp word [ecx], ax
je 0x20014a1a
push 0x9e
push eax
mov word [ebp - 0x6c], ax
lea eax, [ebp - 0x6a]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call edi
push eax
lea eax, [ebp - 0x6c]
push 0x20002b9c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x6c]
push eax
push dword [ebp + 0x34]
call ebx
xor eax, eax
mov ecx, dword [ebp + 0x38]
cmp ecx, eax
je 0x20014a58
cmp word [ecx], ax
je 0x20014a58
push 0x9e
push eax
mov word [ebp - 0x6c], ax
lea eax, [ebp - 0x6a]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 1
call edi
push eax
lea eax, [ebp - 0x6c]
push 0x20002b9c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x6c]
push eax
push dword [ebp + 0x38]
call ebx
xor eax, eax
pop ebx
jmp 0x20014a60
xor eax, eax
inc eax
pop edi
pop esi
add ebp, 0x74
leave
ret

Function at 0x20014ae3
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, dword [esp + 8]
cmp word [ebp], 0x5c
push edi
jne 0x20014b3a
add ebp, 2
push ebp
call fcn.2000c372
xor edi, edi
cmp eax, edi
pop ecx
je 0x20014b20
cmp word [eax], di
je 0x20014b20
push eax
push edi
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, edi
je 0x20014b35
push edi
push edi
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
jmp 0x20014b8e
mov eax, dword [0x2002dce0]
cmp eax, edi
je 0x20014b35
push edi
push edi
push 0x10
push dword [eax + 0x4d0]
jmp 0x20014b16
xor eax, eax
inc eax
jmp 0x20014b8e
push ebx
mov dword [esp + 0x10], 1
xor edi, edi
push esi
push edi
push edi
push ebp
call fcn.2000ca17
mov ebx, eax
add esp, 0xc
cmp ebx, edi
je 0x20014b88
push ebx
push edi
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, edi
je 0x20014b7e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x20014b77
mov dword [esp + 0x14], edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, edi
jbe 0x20014b88
cmp word [ebp], di
jne 0x20014b46
mov eax, dword [esp + 0x14]
pop esi
pop ebx
pop edi
pop ebp
ret
Function at 0x20014ecb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
and word [ebp - 0x208], 0
push 0x206
lea eax, [ebp - 0x206]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 1
push dword [ebp + 0xc]
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x20014f24
push dword [ebp + 0x10]
lea eax, [ebp - 0x208]
push dword [ebp + 8]
push eax
call fcn.20007e9d
xor eax, eax
add esp, 0xc
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x20014f28
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
xor esi, esi
inc esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 2
je 0x20014f50
and eax, 0xfffffffd
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, eax
neg esi
sbb esi, esi
neg esi
mov eax, esi
pop esi
ret

Function at 0x200153e7
Capabilities:
Find taskbar

Disassembly:
push esi
push edi
xor edi, edi
push edi
push 0x20003584
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, edi
je 0x20015429
mov esi, dword [sym.imp.USER32.dll_FindWindowExW]
push edi
push 0x20003568
push edi
push eax
call esi
cmp eax, edi
je 0x20015429
push edi
push 0x20003554
push edi
push eax
call esi
cmp eax, edi
je 0x20015429
push edi
push 0x20003534
push edi
push eax
call esi
jmp 0x2001542b
xor eax, eax
pop edi
pop esi
ret