joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f120
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x540165
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x580280]
xor eax, ebp
mov dword [ebp - 0x2c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x280], ecx
push 0
push 0x10
lea eax, [ebp - 0x254]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x254]
push ecx
lea ecx, [ebp - 0x48]
call fcn.00401280
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x270]
call fcn.00407b20
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.0047c792
mov byte [ebp - 4], 2
push 0x54eb3c
lea ecx, [ebp - 0x48]
call fcn.004078c0
push 0
lea ecx, [ebp - 0x48]
call fcn.004012c0
push eax
lea ecx, [ebp - 0x24]
call fcn.0047c82a
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x42f25b
lea ecx, [ebp - 0x24]
call fcn.0047c492
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x24]
call fcn.0047c753
test eax, eax
je 0x42f1db
jmp 0x42f1b8
lea ecx, [ebp - 0x24]
call fcn.00422d20
test eax, eax
jne 0x42f256
lea edx, [ebp - 0x274]
push edx
lea ecx, [ebp - 0x24]
call fcn.0047cb71
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x288], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x288]
call fcn.00405cf0
push eax
lea ecx, [ebp - 0x270]
call fcn.0040ce50
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x274]
call fcn.00402890
lea ecx, [ebp - 0x270]
call fcn.004622e0
movzx ecx, al
test ecx, ecx
jne 0x42f256
lea edx, [ebp - 0x270]
push edx
mov ecx, dword [ebp - 0x280]
call fcn.00424f10
jmp 0x42f1b8
mov ecx, dword [ebp - 0x280]
call fcn.0042fed0
movzx eax, al
test eax, eax
je 0x42f2a9
mov dword [ebp - 0x278], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.0047c7bb
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x270]
call fcn.00406040
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00406040
mov eax, dword [ebp - 0x278]
jmp 0x42f2e3
mov dword [ebp - 0x27c], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.0047c7bb
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x270]
call fcn.00406040
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00406040
mov eax, dword [ebp - 0x27c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.00486c08
mov esp, ebp
pop ebp
ret
Function at 0x42f300
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5401b6
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x580280]
xor eax, ebp
mov dword [ebp - 0x2c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x280], ecx
lea ecx, [ebp - 0x250]
call fcn.00407b20
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x234], ax
push 0x206
push 0
lea ecx, [ebp - 0x232]
push ecx
call fcn.00486c20
add esp, 0xc
push 0
push 0x1a
lea edx, [ebp - 0x234]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x42f3a0
mov dword [ebp - 0x270], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x250]
call fcn.00406040
mov eax, dword [ebp - 0x270]
jmp 0x42f53b
push str.MicrosoftInternet_ExplorerQuick_Launch
lea eax, [ebp - 0x234]
push eax
call fcn.00486ab7
add esp, 8
lea ecx, [ebp - 0x234]
push ecx
lea ecx, [ebp - 0x250]
call fcn.0040ce50
lea ecx, [ebp - 0x26c]
call fcn.00407b20
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.0047c792
mov byte [ebp - 4], 2
push 0x54eba4
lea ecx, [ebp - 0x250]
call fcn.004078c0
push 0
lea ecx, [ebp - 0x250]
call fcn.004012c0
push eax
lea ecx, [ebp - 0x24]
call fcn.0047c82a
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x42f4ad
lea ecx, [ebp - 0x24]
call fcn.0047c492
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x24]
call fcn.0047c753
test eax, eax
je 0x42f42d
jmp 0x42f40a
lea ecx, [ebp - 0x24]
call fcn.00422d20
test eax, eax
jne 0x42f4a8
lea edx, [ebp - 0x274]
push edx
lea ecx, [ebp - 0x24]
call fcn.0047cb71
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x288], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x288]
call fcn.00405cf0
push eax
lea ecx, [ebp - 0x26c]
call fcn.0040ce50
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x274]
call fcn.00402890
lea ecx, [ebp - 0x26c]
call fcn.004622e0
movzx ecx, al
test ecx, ecx
jne 0x42f4a8
lea edx, [ebp - 0x26c]
push edx
mov ecx, dword [ebp - 0x280]
call fcn.00424f10
jmp 0x42f40a
mov ecx, dword [ebp - 0x280]
call fcn.0042fed0
movzx eax, al
test eax, eax
je 0x42f4fe
mov dword [ebp - 0x278], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.0047c7bb
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x26c]
call fcn.00406040
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x250]
call fcn.00406040
mov eax, dword [ebp - 0x278]
jmp 0x42f53b
mov dword [ebp - 0x27c], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.0047c7bb
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x26c]
call fcn.00406040
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x250]
call fcn.00406040
mov eax, dword [ebp - 0x27c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.00486c08
mov esp, ebp
pop ebp
ret
Function at 0x42f560
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x540204
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x580280]
xor eax, ebp
mov dword [ebp - 0x2c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x280], ecx
push 0
push 0x17
lea eax, [ebp - 0x254]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x254]
push ecx
lea ecx, [ebp - 0x48]
call fcn.00401280
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x270]
call fcn.00407b20
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.0047c792
mov byte [ebp - 4], 2
push 0x54ebb4
lea ecx, [ebp - 0x48]
call fcn.004078c0
push 0
lea ecx, [ebp - 0x48]
call fcn.004012c0
push eax
lea ecx, [ebp - 0x24]
call fcn.0047c82a
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x42f69b
lea ecx, [ebp - 0x24]
call fcn.0047c492
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x24]
call fcn.0047c753
test eax, eax
je 0x42f61b
jmp 0x42f5f8
lea ecx, [ebp - 0x24]
call fcn.00422d20
test eax, eax
jne 0x42f696
lea edx, [ebp - 0x274]
push edx
lea ecx, [ebp - 0x24]
call fcn.0047cb71
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x288], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x288]
call fcn.00405cf0
push eax
lea ecx, [ebp - 0x270]
call fcn.0040ce50
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x274]
call fcn.00402890
lea ecx, [ebp - 0x270]
call fcn.004622e0
movzx ecx, al
test ecx, ecx
jne 0x42f696
lea edx, [ebp - 0x270]
push edx
mov ecx, dword [ebp - 0x280]
call fcn.00424f10
jmp 0x42f5f8
mov ecx, dword [ebp - 0x280]
call fcn.0042fed0
movzx eax, al
test eax, eax
je 0x42f6e9
mov dword [ebp - 0x278], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.0047c7bb
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x270]
call fcn.00406040
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00406040
mov eax, dword [ebp - 0x278]
jmp 0x42f723
mov dword [ebp - 0x27c], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.0047c7bb
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x270]
call fcn.00406040
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00406040
mov eax, dword [ebp - 0x27c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.00486c08
mov esp, ebp
pop ebp
ret
Function at 0x42faa0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5402c9
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x580280]
xor eax, ebp
mov dword [ebp - 0x2c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x280], ecx
push 0
push 0x1a
lea eax, [ebp - 0x254]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x42faef
xor eax, eax
jmp 0x42fc82
push str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar
lea ecx, [ebp - 0x254]
push ecx
call fcn.00486ab7
add esp, 8
lea edx, [ebp - 0x254]
push edx
lea ecx, [ebp - 0x48]
call fcn.00401280
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x270]
call fcn.00407b20
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.0047c792
mov byte [ebp - 4], 2
push str..lnk
lea ecx, [ebp - 0x48]
call fcn.004078c0
push 0
lea ecx, [ebp - 0x48]
call fcn.004012c0
push eax
lea ecx, [ebp - 0x24]
call fcn.0047c82a
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x42fbfa
lea ecx, [ebp - 0x24]
call fcn.0047c492
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x24]
call fcn.0047c753
test eax, eax
je 0x42fb7a
jmp 0x42fb57
lea ecx, [ebp - 0x24]
call fcn.00422d20
test eax, eax
jne 0x42fbf5
lea eax, [ebp - 0x274]
push eax
lea ecx, [ebp - 0x24]
call fcn.0047cb71
mov dword [ebp - 0x284], eax
mov ecx, dword [ebp - 0x284]
mov dword [ebp - 0x288], ecx
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x288]
call fcn.00405cf0
push eax
lea ecx, [ebp - 0x270]
call fcn.0040ce50
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x274]
call fcn.00402890
lea ecx, [ebp - 0x270]
call fcn.004622e0
movzx edx, al
test edx, edx
jne 0x42fbf5
lea eax, [ebp - 0x270]
push eax
mov ecx, dword [ebp - 0x280]
call fcn.00424f10
jmp 0x42fb57
mov ecx, dword [ebp - 0x280]
call fcn.0042fed0
movzx ecx, al
test ecx, ecx
je 0x42fc48
mov dword [ebp - 0x278], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.0047c7bb
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x270]
call fcn.00406040
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00406040
mov eax, dword [ebp - 0x278]
jmp 0x42fc82
mov dword [ebp - 0x27c], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.0047c7bb
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x270]
call fcn.00406040
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00406040
mov eax, dword [ebp - 0x27c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.00486c08
mov esp, ebp
pop ebp
ret
Function at 0x42fca0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
mov eax, dword [0x580280]
xor eax, ebp
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14c], ecx
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [ebp - 0x148], 0x11c
push str.unknown_OperatingSystem.
mov ecx, dword [ebp + 8]
call fcn.0040ce50
lea ecx, [ebp - 0x148]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42fe71
mov edx, dword [ebp - 0x144]
mov dword [ebp - 0x150], edx
cmp dword [ebp - 0x150], 4
je 0x42fd23
cmp dword [ebp - 0x150], 5
je 0x42fd9d
cmp dword [ebp - 0x150], 6
je 0x42fe05
jmp 0x42fe71
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0
je 0x42fd4c
cmp dword [ebp - 0x154], 0xa
je 0x42fd7c
cmp dword [ebp - 0x154], 0x5a
je 0x42fd8b
jmp 0x42fd98
cmp dword [ebp - 0x138], 2
jne 0x42fd64
push 0x54ec98
mov ecx, dword [ebp + 8]
call fcn.0040ce50
jmp 0x42fd7a
cmp dword [ebp - 0x138], 1
jne 0x42fd7a
push 0x54eccc
mov ecx, dword [ebp + 8]
call fcn.0040ce50
jmp 0x42fd98
push 0x54ecf8
mov ecx, dword [ebp + 8]
call fcn.0040ce50
jmp 0x42fd98
push 0x54ed24
mov ecx, dword [ebp + 8]
call fcn.0040ce50
jmp 0x42fe71
mov ecx, dword [ebp - 0x140]
mov dword [ebp - 0x158], ecx
cmp dword [ebp - 0x158], 0
je 0x42fdc6
cmp dword [ebp - 0x158], 1
je 0x42fdd5
cmp dword [ebp - 0x158], 2
je 0x42fde4
jmp 0x42fe03
push 0x54ed50
mov ecx, dword [ebp + 8]
call fcn.0040ce50
jmp 0x42fe03
push 0x54ed80
mov ecx, dword [ebp + 8]
call fcn.0040ce50
jmp 0x42fe03
movzx edx, byte [ebp - 0x2e]
cmp edx, 1
jne 0x42fe03
movzx eax, word [ebp - 0x24]
cmp eax, 9
jne 0x42fe03
push 0x54edb0
mov ecx, dword [ebp + 8]
call fcn.0040ce50
jmp 0x42fe71
mov ecx, dword [ebp - 0x140]
mov dword [ebp - 0x15c], ecx
cmp dword [ebp - 0x15c], 0
je 0x42fe25
cmp dword [ebp - 0x15c], 1
je 0x42fe4c
jmp 0x42fe71
movzx edx, byte [ebp - 0x2e]
cmp edx, 1
jne 0x42fe3d
push 0x54ee0c
mov ecx, dword [ebp + 8]
call fcn.0040ce50
jmp 0x42fe4a
push 0x54ee3c
mov ecx, dword [ebp + 8]
call fcn.0040ce50
jmp 0x42fe71
movzx eax, byte [ebp - 0x2e]
cmp eax, 1
jne 0x42fe64
push 0x54ee78
mov ecx, dword [ebp + 8]
call fcn.0040ce50
jmp 0x42fe71
push 0x54eea0
mov ecx, dword [ebp + 8]
call fcn.0040ce50
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.00486c08
mov esp, ebp
pop ebp
ret 4
Function at 0x434d50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x122c
call fcn.00489eb0
mov eax, dword [0x580280]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x122c], ecx
mov dword [ebp - 4], reloc.WS2_32.dll_bind
xor eax, eax
mov word [ebp - 0x1010], ax
push 0xffe
push 0
lea ecx, [ebp - 0x100e]
push ecx
call fcn.00486c20
add esp, 0xc
mov dword [ebp - 0x1018], 0x54f360
mov dword [ebp - 0x1014], 0
mov dword [ebp - 0x1224], 0x54f390
lea edx, [ebp - 4]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0x1224]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x434ddb
jmp 0x434e88
xor edx, edx
mov word [ebp - 0x1220], dx
push 0x206
push 0
lea eax, [ebp - 0x121e]
push eax
call fcn.00486c20
add esp, 0xc
push 0x54f3fc
push 0x54f428
lea ecx, [ebp - 0x1220]
push ecx
call fcn.00487ebf
add esp, 0xc
lea edx, [ebp - 0x1220]
push edx
call fcn.00486c9a
add esp, 4
shl eax, 1
push eax
lea eax, [ebp - 0x1220]
push eax
push 7
push 0
push 0x54f430
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x122c]
cmp dword [eax], 0
je 0x434e88
push str.RundllInstallA
mov ecx, dword [ebp - 0x122c]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1228], eax
cmp dword [ebp - 0x1228], 0
je 0x434e88
push 0
push 0
push 0
push 0
call dword [ebp - 0x1228]
add esp, 0x10
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00486c08
mov esp, ebp
pop ebp
ret

Function at 0x434ea0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1028
call fcn.00489eb0
mov eax, dword [0x580280]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x1028], ecx
mov dword [ebp - 4], reloc.WS2_32.dll_bind
mov dword [ebp - 0x101c], 0
xor eax, eax
mov word [ebp - 0x1010], ax
push 0xffe
push 0
lea ecx, [ebp - 0x100e]
push ecx
call fcn.00486c20
add esp, 0xc
mov dword [ebp - 0x1018], 0x54f46c
mov dword [ebp - 0x1014], 0
mov dword [ebp - 0x1020], str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvchost
lea edx, [ebp - 0x101c]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0x1020]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x434f35
jmp 0x434f96
push 0x54f504
mov edx, dword [ebp - 0x101c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x101c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x1028]
cmp dword [ecx], 0
je 0x434f96
push str.RundllUninstallA
mov edx, dword [ebp - 0x1028]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1024], eax
cmp dword [ebp - 0x1024], 0
je 0x434f96
push 0
push str.PeopleCalendarService
push 0
push 0
call dword [ebp - 0x1024]
add esp, 0x10
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00486c08
mov esp, ebp
pop ebp
ret
Function at 0x4352c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5407d9
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x580280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x70], ecx
call fcn.004058c0
mov ecx, eax
call fcn.00447800
push eax
lea ecx, [ebp - 0x48]
call fcn.00401280
mov dword [ebp - 4], 0
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00407860
mov byte [ebp - 4], 1
push 0x54f5d0
lea ecx, [ebp - 0x2c]
call fcn.004078c0
lea ecx, [ebp - 0x2c]
call fcn.004012c0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x435356
lea ecx, [ebp - 0x48]
call fcn.004012c0
push ecx
mov ecx, esp
mov dword [ebp - 0x68], esp
push eax
call fcn.00421fb0
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0x70]
call fcn.00435750
cmp dword [ebp + 8], 0
je 0x4353b3
call fcn.004058c0
mov ecx, eax
call fcn.00447840
push eax
lea ecx, [ebp - 0x64]
call fcn.00401280
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x64]
call fcn.004012c0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4353a7
lea ecx, [ebp - 0x64]
call fcn.004012c0
push ecx
mov ecx, esp
mov dword [ebp - 0x6c], esp
push eax
call fcn.00421fb0
mov dword [ebp - 0x78], eax
mov ecx, dword [ebp - 0x70]
call fcn.00435750
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x64]
call fcn.00406040
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00406040
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00406040
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00486c08
mov esp, ebp
pop ebp
ret 4
Function at 0x4353f0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x540824
mov eax, dword fs:[0]
push eax
sub esp, 0x690
mov eax, dword [0x580280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x690], ecx
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0xc]
push eax
push 0x54f5f8
lea ecx, [ebp - 0x21c]
push ecx
call fcn.00487ebf
add esp, 0xc
lea edx, [ebp - 0x474]
push edx
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0xffffffff
je 0x4355d4
lea ecx, [ebp - 0x474]
push ecx
mov edx, dword [ebp - 0x478]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jne 0x43548f
jmp 0x4355d4
movzx eax, word [ebp - 0x448]
cmp eax, 0x2e
jne 0x43549d
jmp 0x43545a
movzx ecx, word [ebp - 0x446]
test ecx, ecx
jne 0x4354aa
jmp 0x43545a
movzx edx, word [ebp - 0x446]
cmp edx, 0x2e
jne 0x4354c3
movzx eax, word [ebp - 0x444]
test eax, eax
jne 0x4354c3
jmp 0x43545a
lea ecx, [ebp - 0x47c]
call fcn.00402870
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x448]
push ecx
push 0x54f604
lea edx, [ebp - 0x47c]
push edx
call fcn.0042c060
add esp, 0xc
mov eax, dword [ebp - 0x474]
and eax, 0x10
je 0x435592
xor ecx, ecx
mov word [ebp - 0x684], cx
push 0x206
push 0
lea edx, [ebp - 0x682]
push edx
call fcn.00486c20
add esp, 0xc
mov eax, dword [ebp - 0x47c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x54f60c
lea edx, [ebp - 0x684]
push edx
call fcn.00487ebf
add esp, 0x10
push ecx
mov ecx, esp
mov dword [ebp - 0x688], esp
lea eax, [ebp + 0x10]
push eax
call fcn.00422d40
mov dword [ebp - 0x694], eax
mov ecx, dword [ebp - 0x694]
mov dword [ebp - 0x698], ecx
mov byte [ebp - 4], 3
push ecx
mov ecx, esp
mov dword [ebp - 0x68c], esp
lea edx, [ebp - 0x684]
push edx
call fcn.00421fb0
mov dword [ebp - 0x69c], eax
mov eax, dword [ebp + 8]
push eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x690]
call fcn.004353f0
jmp 0x4355c0
lea ecx, [ebp - 0x47c]
call fcn.004229f0
lea ecx, [ebp + 0x10]
push ecx
lea edx, [ebp - 0x47c]
push edx
call fcn.00435e20
add esp, 8
movzx eax, al
test eax, eax
je 0x4355c0
mov ecx, dword [ebp + 8]
mov dword [ecx], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x47c]
call fcn.00402890
jmp 0x43545a
mov edx, dword [ebp - 0x478]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00402890
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.00402890
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00486c08
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4356a0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
call fcn.00435be0
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SoftwarePeopleCalendar
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4356e9
push str.NoQuitBufferDlg
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SoftWareMicrosoftWindowsCurrentVersionUninstall
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43572f
push 0x54f6d0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov esp, ebp
pop ebp
ret
Function at 0x435750
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54088d
mov eax, dword fs:[0]
push eax
sub esp, 0x690
mov eax, dword [0x580280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x694], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
push 0x54f6dc
lea ecx, [ebp - 0x21c]
push ecx
call fcn.00487ebf
add esp, 0xc
lea edx, [ebp - 0x474]
push edx
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0xffffffff
je 0x435935
lea ecx, [ebp - 0x474]
push ecx
mov edx, dword [ebp - 0x478]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jne 0x4357ef
jmp 0x435935
movzx eax, word [ebp - 0x448]
cmp eax, 0x2e
jne 0x4357fd
jmp 0x4357ba
movzx ecx, word [ebp - 0x446]
test ecx, ecx
jne 0x43580a
jmp 0x4357ba
movzx edx, word [ebp - 0x446]
cmp edx, 0x2e
jne 0x435823
movzx eax, word [ebp - 0x444]
test eax, eax
jne 0x435823
jmp 0x4357ba
lea ecx, [ebp - 0x47c]
call fcn.00402870
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x448]
push ecx
push 0x54f6e8
lea edx, [ebp - 0x47c]
push edx
call fcn.0042c060
add esp, 0xc
mov eax, dword [ebp - 0x474]
and eax, 0x10
je 0x4358be
xor ecx, ecx
mov word [ebp - 0x684], cx
push 0x206
push 0
lea edx, [ebp - 0x682]
push edx
call fcn.00486c20
add esp, 0xc
mov eax, dword [ebp - 0x47c]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x54f6f0
lea edx, [ebp - 0x684]
push edx
call fcn.00487ebf
add esp, 0x10
push ecx
mov ecx, esp
mov dword [ebp - 0x68c], esp
lea eax, [ebp - 0x684]
push eax
call fcn.00421fb0
mov dword [ebp - 0x698], eax
mov ecx, dword [ebp - 0x694]
call fcn.00435750
jmp 0x435921
lea ecx, [ebp - 0x688]
call fcn.00402870
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x47c]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x54f6fc
lea eax, [ebp - 0x688]
push eax
call fcn.0042c060
add esp, 0x10
push ecx
mov ecx, esp
mov dword [ebp - 0x690], esp
lea edx, [ebp - 0x688]
push edx
call fcn.00422d40
mov dword [ebp - 0x69c], eax
mov ecx, dword [ebp - 0x694]
call fcn.004359b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x688]
call fcn.00402890
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x47c]
call fcn.00402890
jmp 0x4357ba
mov eax, dword [ebp - 0x478]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp + 8]
call fcn.00405cf0
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x435968
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00402890
jmp 0x43598a
push 4
push 0
lea ecx, [ebp + 8]
call fcn.00405cf0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00402890
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00486c08
mov esp, ebp
pop ebp
ret 4