joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443e40
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
mov eax, dword [0x4de57c]
xor eax, esp
mov dword [esp + 0x9c], eax
push esi
mov esi, dword [esp + 0xa8]
push 0x98
lea eax, [esp + 0xc]
push 0
push eax
call fcn.0048ea70
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x443ffd
push str.Platform_Info:_n
push esi
call fcn.00490a6e
push str._______________n
push esi
call fcn.00490a6e
push str.Os_Name:
push esi
call fcn.00490a6e
mov eax, dword [esp + 0x2c]
add esp, 0x18
sub eax, 2
jne 0x443fd0
mov eax, dword [esp + 8]
cmp eax, 5
jne 0x443eec
mov eax, dword [esp + 0xc]
cmp eax, 2
jne 0x443ed5
push str.Microsoft_Windows_Server_2003_
jmp 0x443ef6
cmp eax, 1
jne 0x443ee1
push str.Microsoft_Windows_XP
jmp 0x443ef6
test eax, eax
jne 0x443eff
push str.Microsoft_Windows_2000
jmp 0x443ef6
cmp eax, 4
ja 0x443eff
push str.Microsoft_Windows_NT
push esi
call fcn.00490a6e
add esp, 8
mov al, byte [esp + 0x9e]
cmp al, 1
jne 0x443f3c
cmp dword [esp + 8], 4
jne 0x443f1b
push str.Workstation_4.0
jmp 0x443fc7
test dword [esp + 0x9c], 0x200
je 0x443f32
push str.Home_Edition
jmp 0x443fc7
push str.Professional
jmp 0x443fc7
cmp al, 3
je 0x443f48
cmp al, 2
jne 0x443fd0
cmp dword [esp + 8], 5
jne 0x443fb1
mov eax, dword [esp + 0xc]
cmp eax, 2
jne 0x443f89
mov eax, dword [esp + 0x9c]
test al, al
jns 0x443f6a
push str.Datacenter_Edition
jmp 0x443fc7
test al, 2
je 0x443f75
push str.Enterprise_Edition
jmp 0x443fc7
cmp ax, 0x400
jne 0x443f82
push str.Web_Edition
jmp 0x443fc7
push str.Standard_Edition
jmp 0x443fc7
test eax, eax
jne 0x443fb1
mov al, byte [esp + 0x9c]
test al, al
jns 0x443f9f
push str.Datacenter_Server
jmp 0x443fc7
test al, 2
je 0x443faa
push str.Advanced_Server
jmp 0x443fc7
push str.Server
jmp 0x443fc7
test byte [esp + 0x9c], 2
je 0x443fc2
push str.Server_4.0__Enterprise_Edition
jmp 0x443fc7
push str.Server_4.0
push esi
call fcn.00490a6e
add esp, 8
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0xc]
push eax
push ecx
push edx
push str._nOs_Version:__d._d._d__S_n
push esi
call fcn.00490a6e
push 0x4c17c0
push esi
call fcn.00490a6e
add esp, 0x20
mov ecx, dword [esp + 0xa0]
pop esi
xor ecx, esp
call fcn.0048de34
add esp, 0xa0
ret 4
Function at 0x444020
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
sub esp, 0x128
mov eax, dword [0x4de57c]
xor eax, esp
mov dword [esp + 0x124], eax
push ebx
push esi
mov esi, dword [esp + 0x134]
push edi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push str.Locale_Info:_n
push esi
movzx edi, ax
call fcn.00490a6e
push str._____________n
push esi
call fcn.00490a6e
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
add esp, 0x10
push 0x20
lea eax, [esp + 0x10]
push eax
push 0x1004
push edi
call ebx
lea ecx, [esp + 0xc]
push ecx
push str.DefaultAnsiCodePage:__s_n
push esi
call fcn.00490a6e
add esp, 0xc
push 0x20
lea edx, [esp + 0x10]
push edx
push 0xb
push edi
call ebx
lea eax, [esp + 0xc]
push eax
push str.DefaultCodePage:__s_n
push esi
call fcn.00490a6e
add esp, 0xc
push 0x104
lea ecx, [esp + 0x30]
push ecx
push 6
push edi
call ebx
lea edx, [esp + 0x2c]
push edx
push str.Country:__s_n
push esi
call fcn.00490a6e
add esp, 0xc
push 0x104
lea eax, [esp + 0x30]
push eax
push 2
push edi
call ebx
lea ecx, [esp + 0x2c]
push ecx
push str.Language:__s_n
push esi
call fcn.00490a6e
push 0x4c17c0
push esi
call fcn.00490a6e
mov ecx, dword [esp + 0x144]
add esp, 0x14
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0048de34
add esp, 0x128
ret 4
Function at 0x4443b0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push esi
mov esi, dword [esp + 0x2c]
push str.System_Info:_n
push esi
call fcn.00490a6e
push str._____________n
push esi
call fcn.00490a6e
add esp, 0x10
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 8]
push ecx
push str.PageSize:__u_n
push esi
call fcn.00490a6e
mov edx, dword [esp + 0x2c]
push edx
push str.AllocationGranularity:__u_n
push esi
call fcn.00490a6e
mov eax, dword [esp + 0x24]
push eax
push str.MinimumApplicationAddress:__p_n
push esi
call fcn.00490a6e
mov ecx, dword [esp + 0x34]
push ecx
push str.MaximumApplicationAddress:__p_n
push esi
call fcn.00490a6e
push 0x4c17c0
push esi
call fcn.00490a6e
add esp, 0x38
pop esi
add esp, 0x24
ret 4
Function at 0x4448a0
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x20
push esi
mov esi, dword [esp + 0x28]
push str.Memory_Info:_n
push esi
call fcn.00490a6e
push str._____________n
push esi
call fcn.00490a6e
add esp, 0x10
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [esp + 8]
push ecx
push str.MemoaryLoad:__u_n
push esi
call fcn.00490a6e
mov edx, dword [esp + 0x18]
push edx
push str.TotalPhys:__u_n
push esi
call fcn.00490a6e
mov eax, dword [esp + 0x28]
push eax
push str.AvailPhys:__u_n
push esi
call fcn.00490a6e
mov ecx, dword [esp + 0x38]
push ecx
push str.TotalPageFile:__u_n
push esi
call fcn.00490a6e
mov edx, dword [esp + 0x48]
push edx
push str.AvailPageFile:__u_n
push esi
call fcn.00490a6e
mov eax, dword [esp + 0x58]
push eax
push str.TotalVirtual:__u_n
push esi
call fcn.00490a6e
mov ecx, dword [esp + 0x68]
add esp, 0x48
push ecx
push str.AvailVirtual:__u_n
push esi
call fcn.00490a6e
add esp, 0xc
pop esi
add esp, 0x20
ret 4

Function at 0x444950
Capabilities:
Get hostname
Get session user name

Disassembly:
sub esp, 0x2b4
mov eax, dword [0x4de57c]
xor eax, esp
mov dword [esp + 0x2b0], eax
push esi
mov esi, dword [esp + 0x2bc]
push str.Misc_Info_n
push esi
call fcn.00490a6e
push str.__________n
push esi
call fcn.00490a6e
add esp, 0x10
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0xb8]
push ecx
mov dword [esp + 0xc], 0x200
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x4449ba
lea edx, [esp + 0xb4]
push edx
push str.ComputerName:__s_n
push esi
call fcn.00490a6e
add esp, 0xc
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0xb8]
push ecx
mov dword [esp + 0xc], 0x200
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x4449ef
lea edx, [esp + 0xb4]
push edx
push str.UserName:__s_n
push esi
call fcn.00490a6e
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
push 0x200
lea ecx, [esp + 0xb8]
movzx edx, ax
push ecx
push edx
call sub.KERNEL32.dll_VerLanguageNameA
test eax, eax
je 0x444a28
lea eax, [esp + 0xb4]
push eax
push str.SystemDefaultLangID:__s_n
push esi
call fcn.00490a6e
add esp, 0xc
push 0xa8
lea ecx, [esp + 0x10]
push 0
push ecx
mov dword [esp + 0x14], 0
call fcn.0048ea70
add esp, 0xc
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
cmp eax, 1
jne 0x444a67
lea eax, [esp + 0xc]
push eax
push str.TimeZone:__S_n
push esi
call fcn.00490a6e
add esp, 0xc
push 0x4c17c0
push esi
call fcn.00490a6e
mov ecx, dword [esp + 0x2bc]
add esp, 8
pop esi
xor ecx, esp
call fcn.0048de34
add esp, 0x2b4
ret 4
Function at 0x445180
Capabilities:
Enumerate threads

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x24]
push esi
push edi
push str.Thread_Info:_n
push ebx
mov esi, ecx
call fcn.00490a6e
push str._____________n
push ebx
call fcn.00490a6e
mov eax, dword [esi + 4]
add esp, 0x10
push eax
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x44521c
xor eax, eax
lea ecx, [esp + 0xc]
push ecx
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x14], 0x1c
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x445215
jmp 0x4451f0
mov edx, dword [esp + 0x18]
cmp edx, dword [esi + 4]
jne 0x445206
lea eax, [esp + 0xc]
push eax
push ebx
mov ecx, esi
call fcn.00444fa0
lea ecx, [esp + 0xc]
push ecx
push edi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x4451f0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 4

Function at 0x446ea0
Capabilities:
Create process memory minidump

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4de57c]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
mov ebx, dword [esp + 0x214]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
push edi
push 0x104
lea eax, [esp + 0x14]
push eax
push 0
mov edi, ecx
call ebp
push str..log
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionA]
lea edx, [esp + 0x10]
push 0x4c24c0
push edx
call fcn.0048f69c
mov esi, eax
add esp, 8
test esi, esi
je 0x446fc2
push str.Crash_Report_n
push esi
call fcn.00490a6e
push str._____________n
push esi
call fcn.00490a6e
push 0x103
lea eax, [esp + 0x129]
push 0
push eax
mov byte [esp + 0x130], 0
call fcn.0048ea70
add esp, 0x1c
push 0x104
lea ecx, [esp + 0x118]
push ecx
push 0
call ebp
lea edx, [esp + 0x114]
push edx
push str.Exe:__s_n
push esi
call fcn.00490a6e
push 0x4c17c0
push esi
call fcn.00490a6e
add esp, 0x14
push esi
mov ecx, edi
call fcn.00443e40
push esi
mov ecx, edi
call fcn.00444020
push esi
mov ecx, edi
call fcn.00444120
push esi
mov ecx, edi
call fcn.004443b0
push esi
mov ecx, edi
call fcn.00444440
push esi
mov ecx, edi
call fcn.004448a0
push esi
mov ecx, edi
call fcn.00444950
push ebx
push esi
mov ecx, edi
call fcn.00446a40
push esi
mov ecx, edi
call fcn.00444d90
push esi
mov ecx, edi
call fcn.00445180
push esi
call fcn.0048f3b5
add esp, 4
push str..dmp
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionA]
push 0
push 0
push 2
push 0
push 0
push 0xc0000000
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x44700f
mov edx, dword [edi + 4]
mov eax, dword [edi]
push 0
push 0
push 0
push 0
push esi
push edx
push eax
call sub.dbghelp.dll_MiniDumpWriteDump
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x218]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0048de34
add esp, 0x20c
ret 4
Function at 0x447060
Capabilities:
Hide graphical window
Print debug messages

Disassembly:
sub esp, 0x110
mov eax, dword [0x4de57c]
xor eax, esp
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x11c]
push ebx
mov ebx, dword [esp + 0x11c]
push ebp
mov ebp, dword [esp + 0x11c]
push esi
push edi
push ebp
mov esi, ecx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
jne 0x4470ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebp
lea ecx, [esp + 0x24]
push str.LoadLibrary___s___failed__error_code___08X_
push ecx
call fcn.0048f076
add esp, 0x10
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x44719b
push str.InitModuleInterface
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
test ecx, ecx
mov dword [esp + 0x14], ecx
jne 0x44710b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push ebp
lea eax, [esp + 0x28]
push str.GetProcAddress___s___08X____InitModuleInterface___failed__error_code___08X_
push eax
call fcn.0048f076
add esp, 0x14
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x44719b
mov eax, dword [esi + 0x374]
test eax, eax
jne 0x447119
xor edi, edi
jmp 0x447121
mov edi, dword [esi + 0x378]
sub edi, eax
test eax, eax
je 0x44712f
mov edx, dword [esi + 0x378]
sub edx, eax
jne 0x447138
call fcn.0048ed51
mov ecx, dword [esp + 0x14]
mov eax, dword [esi + 0x374]
mov edx, dword [esi + 4]
push edi
push eax
mov eax, dword [esp + 0x18]
push eax
push edx
push ebx
call ecx
add esp, 0x14
test eax, eax
jne 0x44715a
mov eax, 1
jmp 0x44719d
push eax
push ebp
lea eax, [esp + 0x24]
push str.Failed_to_fetch_the_interface_from_module__s__error_code___08X
push eax
call fcn.0048f076
add esp, 0x10
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebx]
test eax, eax
je 0x44719b
mov edx, dword [eax + 8]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44719b
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048de34
add esp, 0x110
ret 0xc

Function at 0x4483c0
Capabilities:
Create process on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, ecx
lea ebx, [edi + 0x454]
mov esi, ebp
push ebx
shr esi, 0x10
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x44842a
movzx eax, bp
push esi
push eax
push ebx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x44842a
cmp dword [edi + 0x478], 0
je 0x44842a
cmp dword [edi + 0x47c], 0x10
jb 0x44840a
mov edi, dword [edi + 0x468]
jmp 0x448410
add edi, 0x468
push 1
push 0
push 0
push edi
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
mov eax, dword [edi + 4]
push ebp
push 2
push 0xa1
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [ecx], 0
xor eax, eax
pop ebx
ret 0x10
Function at 0x44dd30
Capabilities:
Access peb ldr_data
Enumerate gui resources

Disassembly:
push 0xffffffffffffffff
push 0x4b8e68
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4de57c]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
push edi
mov eax, dword [0x4de57c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor esi, esi
push 0xffffffffffffffff
push esi
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x44], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], esi
mov word [esp + 0x20], si
call fcn.0044ae60
lea ecx, [esp + 0xc]
push ecx
push 0x448240
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [esp + 0x28], 8
mov edi, dword [esp + 0xc]
jb 0x44ddb4
mov edx, dword [esp + 0x14]
push edx
call fcn.0048d433
add esp, 4
cmp dword [esp + 0x58], 8
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], esi
mov word [esp + 0x14], si
jb 0x44ddd9
mov eax, dword [esp + 0x44]
push eax
call fcn.0048d433
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0048de34
add esp, 0x30
ret
Function at 0x44df80
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x4b8f14
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4de57c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
push 0x40dd70
push 0x40d720
push 0xd
push 4
lea ebp, [esi + 8]
push ebp
mov dword [esi], vtable.CDialogLoginX_class_DlgLogin__1_.0
call fcn.0048f2dd
xor ebx, ebx
lea edi, [esi + 0x3c]
mov dword [esp + 0x20], ebx
mov eax, edi
mov ecx, 4
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
add eax, 0x10
sub ecx, 1
jns 0x44dfd8
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
mov eax, 0xf
mov dword [esi + 0xd0], eax
mov dword [esi + 0xcc], ebx
mov byte [esi + 0xbc], bl
lea ecx, [esi + 0xd4]
push 4
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], ebx
push 0x4bfb44
mov byte [esp + 0x28], 1
mov byte [ecx + 4], bl
call fcn.00401e90
mov dword [esi + 0xf0], ebx
mov dword [esi + 0xf4], ebx
push edi
mov edi, dword [sym.imp.USER32.dll_SetRectEmpty]
mov dword [esi + 4], ebx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xac], ebx
call edi
lea eax, [esi + 0x4c]
push eax
call edi
lea ecx, [esi + 0x5c]
push ecx
call edi
lea edx, [esi + 0x6c]
push edx
call edi
mov eax, dword [esi + 0xf4]
cmp eax, ebx
je 0x44e0a5
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0xf4], ebx
push str.xunyoubar.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.LOGINCAPTIONCLOSEBTN
push eax
mov dword [esi + 0xf4], eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
mov edi, eax
mov eax, dword [ebp]
cmp eax, ebx
je 0x44e0d6
cmp eax, edi
je 0x44e0d6
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp edi, ebx
mov dword [ebp], edi
jne 0x44e0f8
push 0x10
push 0x4bfaf0
push 0x4bfad4
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xd2965b
push 1
push ebx
call dword [sym.imp.GDI32.dll_CreatePen]
mov dword [esi + 0xf0], eax
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x456dc0
Capabilities:
Hide graphical window

Disassembly:
test ecx, ecx
push esi
je 0x456dca
lea esi, [ecx - 0x28]
jmp 0x456dcc
xor esi, esi
mov eax, dword [esi + 4]
push 6
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 4]
push 0
push 0xf020
push 0x112
push ecx
call dword [sym.imp.USER32.dll_DefWindowProcA]
pop esi
ret
Function at 0x459e60
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x214
mov eax, dword [0x4de57c]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
mov ebx, dword [esp + 0x220]
push esi
push edi
mov edi, dword [esp + 0x224]
xor esi, esi
push esi
mov dword [esp + 0x10], esi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0xc]
push eax
push 0x4c4460
push 1
push esi
push 0x4c4690
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x459f33
mov eax, dword [esp + 0xc]
cmp eax, esi
je 0x459f33
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push ebx
push eax
call edx
test eax, eax
jl 0x459f33
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x14], esi
mov ecx, dword [eax]
push 0x4c4ac0
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jl 0x459f27
cmp dword [esp + 0x10], esi
je 0x459f27
push 0x104
lea ecx, [esp + 0x18]
push ecx
push 0xffffffffffffffff
push edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
push 2
lea ecx, [esp + 0x18]
push ecx
push eax
call edx
xor ecx, ecx
test eax, eax
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
setge cl
push eax
mov eax, dword [edx + 8]
mov esi, ecx
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esp + 0x21c]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.0048de34
add esp, 0x214
ret 8

Function at 0x45a040
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
mov edi, ecx
jne 0x45a056
push 0x80004005
call fcn.00405d80
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0xc]
mov edx, dword [edi]
add eax, 1
push eax
mov eax, dword [esp + 0x18]
push esi
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
ret 0xc
Function at 0x45a0e0
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x4ba328
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4de57c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
push 0x40dd70
push 0x40d720
push 0xd
push 4
lea ebp, [esi + 8]
push ebp
mov dword [esi], vtable.CDialogX_class_CSysSetting__2_.0
call fcn.0048f2dd
xor ebx, ebx
lea edi, [esi + 0x3c]
mov dword [esp + 0x20], ebx
mov eax, edi
mov ecx, 5
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
add eax, 0x10
sub ecx, 1
jns 0x45a138
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], ebx
mov eax, 0xf
mov dword [esi + 0xe4], eax
mov dword [esi + 0xe0], ebx
mov byte [esi + 0xd0], bl
lea ecx, [esi + 0xe8]
push 4
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], ebx
push 0x4bfb44
mov byte [esp + 0x28], 1
mov byte [ecx + 4], bl
call fcn.00401e90
lea ecx, [esi + 0x104]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
mov byte [ecx + 4], bl
mov dword [esi + 0x120], ebx
mov dword [esi + 0x124], ebx
mov dword [esi + 0x128], ebx
mov dword [esi + 0x12c], ebx
push ebx
push 0x4bf904
mov byte [esp + 0x28], 7
mov dword [esi + 4], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc0], ebx
call fcn.00401e90
push edi
mov edi, dword [sym.imp.USER32.dll_SetRectEmpty]
call edi
lea eax, [esi + 0x4c]
push eax
call edi
lea ecx, [esi + 0x5c]
push ecx
call edi
lea edx, [esi + 0x6c]
push edx
call edi
lea eax, [esi + 0x8c]
push eax
call edi
mov eax, dword [esi + 0x12c]
cmp eax, ebx
je 0x45a23d
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0x12c], ebx
push str.xunyoubar.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.IDB_BITMAP_CAPTION_CLOSE_BTN_SW
mov ecx, eax
push ecx
mov dword [esi + 0x12c], eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
mov edi, eax
mov eax, dword [ebp]
cmp eax, ebx
je 0x45a270
cmp eax, edi
je 0x45a270
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebp], edi
mov edx, dword [esi + 0x12c]
push str.IDB_BITMAP_CAPTION_BKGND_SW
push edx
call dword [sym.imp.USER32.dll_LoadBitmapA]
mov edi, eax
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x45a299
cmp eax, edi
je 0x45a299
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esi + 0x18], edi
cmp dword [ebp], ebx
je 0x45a2cf
cmp edi, ebx
je 0x45a2cf
push 0xd2975c
push 1
push ebx
call dword [sym.imp.GDI32.dll_CreatePen]
mov dword [esi + 0x128], eax
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push 0x10
push 0x4bfaf0
push 0x4bfad4
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x45b2f0
Capabilities:
Hide graphical window

Disassembly:
test ecx, ecx
push esi
je 0x45b2fa
lea esi, [ecx - 0x20]
jmp 0x45b2fc
xor esi, esi
mov eax, dword [esi + 4]
push 6
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 4]
push 0
push 0xf020
push 0x112
push ecx
call dword [sym.imp.USER32.dll_DefWindowProcA]
pop esi
ret