joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4329ef
Capabilities:
Check if file exists
Create process on windows
Initialize iwebbrowser2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x5c2460]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x1c]
call fcn.004327fd
cmp dword [ebp - 0xc], 0
push 8
pop ebx
je 0x432a52
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 8], ebx
jae 0x432a1f
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x432a52
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 8], ebx
jae 0x432a35
lea eax, [ebp - 0x1c]
push 0xa
push 0
push esi
push eax
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x432ae5
and dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
push 0x53584c
push 0x15
push 0
push 0x53585c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x432a76
xor esi, esi
jmp 0x432ae8
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x432ae5
and dword [ebp - 0x24], 0
lea edx, [ebp - 0x24]
mov eax, dword [ecx]
push edx
push ecx
call dword [eax + 0x94]
cmp dword [ebp - 0x24], 0
je 0x432aa8
push dword [ebp - 0x24]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 1
push dword [ebp - 0x24]
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea edx, [ebp - 0x38]
mov word [ebp - 0x48], bx
push edx
mov esi, eax
xor eax, eax
push edx
mov word [ebp - 0x38], ax
mov eax, dword [ebp - 0x20]
push edx
push edx
mov dword [ebp - 0x40], esi
lea edx, [ebp - 0x48]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xd0]
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor esi, esi
inc esi
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.0040536f
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00501d03
mov esp, ebp
pop ebp
ret
Function at 0x432b59
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ac
mov eax, dword [0x5c2460]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x26
pop ecx
mov esi, str.softwaremicrosoftwindows_shellAssociationsUrlAssociations_lsUserChoice
mov dword [ebp - 0xb4], 0x541160
lea edi, [ebp - 0xa8]
mov dword [ebp - 0xb0], 0x54183c
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov dword [ebp - 0xac], 0x541834
mov ebx, eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xf4], ebx
movsw word es:[edi], word [esi]
mov dword [ebp - 0xec], eax
mov esi, eax
mov dword [ebp - 0xe8], eax
xor edi, edi
push dword [ebp + esi*4 - 0xb4]
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xe4]
push eax
call fcn.00465c00
mov eax, dword [ebp - 0xe4]
add esp, 0xc
cmp dword [ebp - 0xd0], 8
jae 0x432bf1
lea eax, [ebp - 0xe4]
push 0xf003f
push eax
push SysReAllocString
lea ecx, [ebp - 0xf0]
call fcn.0045b6e0
test eax, eax
jne 0x432c92
mov word [ebp - 0xcc], ax
lea ecx, [ebp - 0xf0]
lea eax, [ebp - 0xcc]
mov dword [ebp - 0xb8], 7
push eax
push str.Progid
mov dword [ebp - 0xbc], edi
call fcn.0045ba20
test eax, eax
jne 0x432c79
mov edx, 0x541018
lea ecx, [ebp - 0xcc]
call fcn.004153e9
test al, al
je 0x432c79
test bl, 1
je 0x432c68
lea ecx, [ebp - 0x1a8]
and ebx, 0xfffffffe
call fcn.0045cee0
push str.Progid
push dword [ebp - 0xf0]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0xf0]
call fcn.0045b7c0
push edi
push 1
lea ecx, [ebp - 0xcc]
call fcn.0040536f
push edi
push 1
lea ecx, [ebp - 0xe4]
call fcn.0040536f
inc esi
cmp esi, 3
jb 0x432bbf
lea ecx, [ebp - 0xf0]
call fcn.0045b550
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00501d03
mov esp, ebp
pop ebp
ret
Function at 0x433815
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x5c2460]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x769784]
push ebx
push esi
push edi
push 7
xor ebx, ebx
mov edi, ecx
pop esi
test al, 1
jne 0x433862
or eax, 1
mov dword [0x76979c], esi
mov dword [0x769784], eax
xor eax, eax
push 0x5341cb
mov dword [0x769798], ebx
mov word [0x769788], ax
call fcn.0050263f
pop ecx
cmp dword [0x769798], ebx
jne 0x4339fb
xor eax, eax
mov dword [ebp - 0x214], esi
push 0x6d
lea edx, [ebp - 0x228]
mov dword [ebp - 0x218], ebx
pop ecx
mov word [ebp - 0x228], ax
call fcn.0045c120
test al, al
je 0x4339d0
push ecx
push ecx
mov esi, esp
mov eax, str.360se360se.ini
push eax
mov dword [esi], eax
call fcn.004049e1
pop ecx
mov dword [esi + 4], eax
lea ecx, [ebp - 0x228]
lea eax, [ebp - 0x240]
push eax
call fcn.00459bb0
push eax
lea ecx, [ebp - 0x228]
call fcn.00459060
lea ecx, [ebp - 0x240]
call fcn.00459030
cmp dword [ebp - 0x214], 8
mov eax, dword [ebp - 0x228]
jae 0x4338ec
lea eax, [ebp - 0x228]
push eax
push ebx
push str.IE6Mode
push str.option
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
jne 0x43395c
push ecx
push ecx
mov esi, esp
mov eax, str.360seie6.ini
push eax
mov dword [esi], eax
call fcn.004049e1
pop ecx
mov dword [esi + 4], eax
lea eax, [ebp - 0x240]
push eax
push ecx
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x228]
call fcn.00459820
pop ecx
mov ecx, eax
call fcn.00459bb0
push eax
lea ecx, [ebp - 0x228]
call fcn.00459060
lea ecx, [ebp - 0x240]
call fcn.00459030
lea ecx, [ebp - 0x258]
call fcn.00459030
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.005091d0
mov eax, dword [ebp - 0x228]
add esp, 0xc
cmp dword [ebp - 0x214], 8
jae 0x43398f
lea eax, [ebp - 0x228]
push eax
push 0x103
lea eax, [ebp - 0x210]
push eax
push 0x54020c
push 0x5401cc
push str.main
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
call fcn.004049e1
pop ecx
push eax
lea eax, [ebp - 0x210]
mov ecx, 0x769788
push eax
call fcn.004152a1
cmp dword [0x769798], ebx
jne 0x4339f0
mov esi, 0x54b758
push esi
call fcn.004049e1
pop ecx
push eax
push esi
mov ecx, 0x769788
call fcn.00405941
lea ecx, [ebp - 0x228]
call fcn.00459030
push 0x769788
mov ecx, edi
call fcn.00409846
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00501d03
mov esp, ebp
pop ebp
ret

Function at 0x433c2e
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x5c2460]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x1c]
push str.Software360360se6Chrome
call fcn.004058f0
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x433c5b
lea eax, [ebp - 0x1c]
push 0xf003f
push eax
push SysReAllocString
lea ecx, [ebp - 0x28]
call fcn.0045b490
push str.joininexperience
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x28]
call fcn.0045b550
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.0040536f
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00501d03
mov esp, ebp
pop ebp
ret
Function at 0x434cda
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, ecx
mov ecx, dword [ebp + 0x14]
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x10], eax
mov dword [ecx], esi
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
inc ebx
push edi
mov dword [ebp - 0xc], ebx
mov dword [ecx], esi
mov ecx, dword [ebp + 0xc]
mov dword [ecx], esi
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x434dbb
add edi, 2
lea eax, [edi + edi]
test eax, eax
je 0x434dac
push eax
call fcn.0050283e
mov esi, eax
pop ecx
test esi, esi
je 0x434dac
lea eax, [edi + edi]
push eax
push 0
push esi
call fcn.005091d0
add esp, 0xc
push esi
push edi
push 0
push dword [ebp - 0x10]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x434dac
and dword [ebp - 8], 0
lea eax, [ebp - 8]
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
push eax
push 0x53fe1c
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x434dac
mov edx, dword [ebp - 4]
test edx, edx
je 0x434dac
cmp dword [ebp - 8], edi
jae 0x434dac
mov ecx, dword [edx + 8]
mov eax, ecx
mov edi, dword [ebp + 8]
mov edx, dword [edx + 0xc]
shr eax, 0x10
mov dword [edi], eax
movzx eax, cx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, edx
mov ecx, dword [ebp + 0x10]
shr eax, 0x10
mov dword [ecx], eax
mov ecx, dword [ebp + 0x14]
movzx eax, dx
mov dword [ecx], eax
jmp 0x434dae
xor ebx, ebx
test esi, esi
je 0x434db9
push esi
call fcn.0050269b
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x435817
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x5c2460]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov dword [ebp - 0x94], ecx
lea ecx, [ebp + 8]
push edi
call fcn.004584a0
mov esi, eax
test esi, esi
je 0x4359c5
push esi
xor ebx, ebx
lea eax, [ebp - 0x3c]
push 0x10
inc ebx
push ebx
push eax
call fcn.00502d14
add esp, 0x10
cmp eax, 0x10
jb 0x4359c5
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x3c]
call fcn.00435103
test al, al
je 0x4359c5
push dword [ebp - 0x34]
xor eax, eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
call fcn.00435c34
mov edi, dword [ebp - 0x20]
push esi
push dword [ebp - 0x34]
push ebx
push edi
call fcn.00502d14
add esp, 0x10
cmp eax, dword [ebp - 0x34]
jae 0x4358a7
xor bl, bl
jmp 0x4359b8
push dword [ebp - 0x30]
xor eax, eax
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
call fcn.00435c34
push esi
push dword [ebp - 0x30]
push ebx
push dword [ebp - 0x90]
call fcn.00502d14
add esp, 0x10
cmp eax, dword [ebp - 0x30]
jae 0x4358e8
xor bl, bl
jmp 0x4359a3
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x54]
and dword [ebp - 0x44], 0
sub eax, edi
push eax
push edi
mov dword [ebp - 0x40], 0xf
mov byte [ebp - 0x54], 0
call fcn.004053c0
cmp dword [ebp - 0x40], 0x10
mov eax, dword [ebp - 0x54]
jae 0x435912
lea eax, [ebp - 0x54]
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x18], eax
call fcn.0047f54a
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x2c]
call fcn.00466120
pop ecx
mov edx, eax
lea ecx, [ebp - 0x6c]
call fcn.004362fb
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00405320
lea ecx, [ebp - 0x6c]
call fcn.0043501e
cmp dword [ebp - 0x58], 0x10
mov eax, dword [ebp - 0x6c]
jae 0x43595c
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x5c]
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x18], eax
call fcn.00461c00
mov ecx, dword [ebp - 0x94]
push eax
call fcn.004075c9
push 0
push ebx
lea ecx, [ebp - 0x84]
call fcn.0040536f
push 0
push ebx
lea ecx, [ebp - 0x6c]
call fcn.00405320
push 0
push ebx
lea ecx, [ebp - 0x54]
call fcn.00405320
cmp dword [ebp - 0x90], 0
je 0x4359b8
push dword [ebp - 0x90]
call fcn.0050269b
pop ecx
test edi, edi
je 0x4359c7
push edi
call fcn.0050269b
pop ecx
jmp 0x4359c7
xor bl, bl
test esi, esi
je 0x4359d2
push esi
call fcn.005035e9
pop ecx
lea ecx, [ebp + 8]
call fcn.00459030
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00501d03
mov esp, ebp
pop ebp
ret
Function at 0x436c99
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x5c2460]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
push edi
test ecx, ecx
je 0x436def
cmp dword [esi + 0x10], 0
je 0x436def
and dword [ebp - 0x244], 0
lea eax, [ebp - 0x244]
push eax
push ecx
xor bl, bl
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 0x244], 0
je 0x436deb
push dword [ebp - 0x244]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x436deb
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.005091d0
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x208
push eax
push edi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x436de4
cmp eax, 0x208
jae 0x436de4
cmp eax, dword [esi + 0x10]
jbe 0x436de4
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x228]
call fcn.004058f0
push 2
push 0xffffffffffffffff
push 0x54d158
lea ecx, [ebp - 0x228]
call fcn.0040bcec
cmp eax, 0xffffffff
je 0x436dad
push 0xffffffffffffffff
inc eax
lea ecx, [ebp - 0x228]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.004075ee
push eax
lea ecx, [ebp - 0x228]
call fcn.004075c9
push 0
push 1
lea ecx, [ebp - 0x240]
call fcn.0040536f
push ecx
push ecx
mov ecx, esp
push esi
call fcn.004050d6
push ecx
push ecx
lea eax, [ebp - 0x228]
mov ecx, esp
push eax
call fcn.004050d6
call fcn.0041859e
add esp, 0x10
test al, al
je 0x436dd5
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x228]
call fcn.0040536f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
jmp 0x436df1
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00501d03
mov esp, ebp
pop ebp
ret
Function at 0x438d53
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
mov eax, dword [0x5c2460]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [0x768c2c]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0xa0], eax
push edx
call fcn.004050d6
lea eax, [ebp - 0x68]
mov ecx, esi
push eax
call fcn.00459bb0
lea ecx, [ebp - 0x68]
call fcn.00457b40
test al, al
je 0x438f45
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x38]
call fcn.00409846
push 0xffffffffffffffff
push 0
push ebx
lea ecx, [ebp - 0x38]
call fcn.00415344
push 0x40
xor ebx, ebx
lea eax, [ebp - 0xf8]
push ebx
push eax
call fcn.005091d0
xor eax, eax
mov dword [ebp - 0xfc], 0x44
add esp, 0xc
mov word [ebp - 0xcc], ax
cmp dword [ebp - 0x24], 8
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xd0], 1
jae 0x438df7
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0xb0]
push ecx
lea ecx, [ebp - 0xfc]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x438f3a
push dword [ebp - 0xac]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push 0x1388
push dword [ebp - 0xb0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
or dword [ebp - 0x9c], 0xffffffff
lea eax, [ebp - 0x9c]
push eax
push dword [ebp - 0xb0]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0xb0]
call esi
cmp dword [ebp - 0x9c], ebx
jne 0x438f3a
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x68]
call fcn.004599a0
push ebx
push 0xf4240
push ebx
push 2
pop edx
mov ecx, eax
call fcn.00470b30
add esp, 0xc
lea ecx, [ebp - 0x50]
call fcn.00459030
push 0xf003f
push str.software
push SysReAllocString
lea ecx, [ebp - 0x44]
call fcn.0045b490
cmp dword [ebp - 0x44], ebx
je 0x438ebd
cmp dword [edi + 0x14], 8
jb 0x438eb4
mov edi, dword [edi]
push edi
lea ecx, [ebp - 0x44]
call fcn.0045b800
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x20]
call fcn.00458f80
cmp dword [ebp - 0xa0], ebx
je 0x438f03
lea eax, [ebp - 0x98]
push eax
push ecx
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x20]
call fcn.00459820
pop ecx
mov ecx, eax
call fcn.00459820
push eax
lea ecx, [ebp - 0x20]
call fcn.00459060
lea ecx, [ebp - 0x98]
call fcn.00459030
jmp 0x438f18
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x20]
call fcn.00459820
push eax
lea ecx, [ebp - 0x20]
call fcn.00459060
lea ecx, [ebp - 0x80]
call fcn.00459030
mov dl, 1
lea ecx, [ebp - 0x20]
call fcn.004575a0
lea ecx, [ebp - 0x20]
call fcn.00459030
lea ecx, [ebp - 0x44]
call fcn.0045b550
push ebx
push 1
lea ecx, [ebp - 0x38]
call fcn.0040536f
lea ecx, [ebp - 0x68]
call fcn.00459030
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00501d03
mov esp, ebp
pop ebp
ret
Function at 0x439889
Capabilities:
Check if file exists
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x448
mov eax, dword [0x5c2460]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0xf003f
push str.CLSID0002DF01_0000_0000_C000_000000000046LocalServer32
mov edi, ecx
lea ecx, [ebp - 0x444]
push SysReAllocString
call fcn.0045b490
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.005091d0
add esp, 0xc
mov dword [ebp - 0x438], 1
xor eax, eax
mov dword [ebp - 0x434], 0x208
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push esi
xor esi, esi
push esi
push eax
call fcn.005091d0
add esp, 0xc
lea eax, [ebp - 0x418]
push esi
push 0x26
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x418]
push eax
push str._sInternet_Exploreriexplore.exe
lea eax, [ebp - 0x210]
push 0x103
push eax
call fcn.005028f6
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x210]
add esp, 0x10
push eax
call esi
test eax, eax
jne 0x43998b
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x438]
push eax
push 0x53fc30
push 0x54cc70
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x210]
push eax
call esi
test eax, eax
jne 0x43998b
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x430]
call fcn.004058f0
mov esi, 0x540808
push esi
call fcn.004049e1
pop ecx
push eax
push esi
push ecx
lea ecx, [ebp - 0x430]
call fcn.00435c7a
push esi
call fcn.004049e1
pop ecx
push eax
push esi
lea ecx, [ebp - 0x430]
call fcn.004152a1
cmp dword [ebp - 0x41c], 8
mov eax, dword [ebp - 0x430]
jae 0x4399e0
lea eax, [ebp - 0x430]
push eax
push 0x53fc30
lea ecx, [ebp - 0x444]
call fcn.0045bc00
push 0
push 1
lea ecx, [ebp - 0x430]
mov dword [edi], 6
call fcn.0040536f
lea ecx, [ebp - 0x444]
call fcn.0045b550
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00501d03
mov esp, ebp
pop ebp
ret
Function at 0x43b9b6
Capabilities:
Get common file path
Move file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
mov eax, dword [0x5c2460]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x420]
mov esi, ecx
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x43bb28
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x438]
call fcn.004058f0
mov edi, str.FA2CD249_E6BC.ini
push edi
call fcn.004049e1
pop ecx
push eax
push edi
lea ecx, [ebp - 0x438]
call fcn.004152a1
mov eax, dword [ebp - 0x438]
push 8
pop edi
cmp dword [ebp - 0x424], edi
jae 0x43ba2e
lea eax, [ebp - 0x438]
xor ebx, ebx
push ebx
push 0x100
push 4
push ebx
push ebx
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x43bb15
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.005091d0
mov eax, dword [ebp - 0x438]
add esp, 0xc
cmp dword [ebp - 0x424], edi
jae 0x43ba88
lea eax, [ebp - 0x438]
push eax
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0x53fc30
push 0x548b50
push str.revert
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x43bac8
cmp dword [esi + 0x14], edi
jb 0x43bab7
mov ecx, dword [esi]
jmp 0x43bab9
mov ecx, esi
lea edx, [ebp - 0x210]
call fcn.004319e4
test eax, eax
jle 0x43baf5
mov eax, dword [ebp - 0x438]
cmp dword [ebp - 0x424], edi
jae 0x43badc
lea eax, [ebp - 0x438]
cmp dword [esi + 0x14], edi
jb 0x43bae3
mov esi, dword [esi]
push eax
push esi
push 0x548b50
push str.revert
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [ebp - 0x438]
cmp dword [ebp - 0x424], edi
jae 0x43bb09
lea eax, [ebp - 0x438]
push 4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x438]
call fcn.0040536f
mov al, bl
jmp 0x43bb2a
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00501d03
mov esp, ebp
pop ebp
ret
Function at 0x43bc4e
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5c2460]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 2
push ebx
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x21], bl
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
je 0x43bc80
call fcn.0043242a
jmp 0x43bc84
mov byte [ebp - 0x21], 1
call fcn.004332be
mov ecx, eax
call fcn.004332e7
call fcn.00431e75
call fcn.0042eea1
mov esi, eax
call fcn.00433b3a
mov byte [esi + 4], al
call fcn.0042eea1
push 1
push 0x64
call fcn.0042f55d
mov ecx, edi
call fcn.00432f49
test al, al
jne 0x43bcc4
mov esi, ebx
jmp 0x43bd7b
xor eax, eax
mov dword [ebp - 0xc], 7
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], ebx
mov word [ebp - 0x20], ax
call fcn.00432248
push ecx
cmp dword [ebp - 0x10], ebx
jne 0x43bcf0
mov ecx, 0x60f
call fcn.0042ae1d
mov esi, ebx
jmp 0x43bd6f
push 0x50
pop edx
mov ecx, 0x60a
call fcn.0042ae08
mov esi, dword [0x768cd0]
lea eax, [ebp - 0x20]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, eax
mov ecx, esi
call fcn.004394ee
pop ecx
push 8
mov edi, eax
pop esi
cmp edi, esi
jne 0x43bd31
push ecx
push 0x5a
pop edx
mov ecx, 0x60a
call fcn.0042ae08
jmp 0x43bd6f
call fcn.0042eea1
cmp edi, 6
sete byte [0x5c38d8]
cmp edi, 6
jne 0x43bd53
call fcn.0042eea1
push 1
push 0x6e
call fcn.0042f55d
call fcn.004171a1
mov ecx, eax
call fcn.0041707a
push ecx
push 0x64
pop edx
mov ecx, 0x60a
call fcn.0042ae08
mov esi, edi
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x20]
call fcn.0040536f
cmp byte [ebp - 0x21], bl
je 0x43bd86
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00501d03
mov esp, ebp
pop ebp
ret 4
Function at 0x43d149
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x5c2460]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x21c], eax
mov edi, ecx
lea eax, [ebp - 0x210]
xor ecx, ecx
push eax
push 0x5357fc
push 1
push ecx
push 0x53586c
mov ebx, edx
mov dword [ebp - 0x218], ecx
mov esi, ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x214], ecx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x43d27d
mov eax, dword [ebp - 0x210]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.005091d0
mov ecx, edi
add esp, 0xc
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x218]
jne 0x43d1d4
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push edi
push eax
call fcn.005056dd
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x20c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov edx, dword [ebp - 0x21c]
test edx, edx
je 0x43d22f
mov eax, dword [ebp - 0x210]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x210]
push 0xfffffffffffffffc
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x214]
push edx
push 0x53581c
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x43d27d
mov eax, dword [ebp - 0x214]
push 2
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
test eax, eax
js 0x43d27d
xor eax, eax
xor esi, esi
push eax
push ebx
push 5
push 2
inc esi
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x43d28d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x210]
test ecx, ecx
je 0x43d29d
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00501d03
mov esp, ebp
pop ebp
ret