joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5af8c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], ecx
mov eax, dword [ebp - 0x210]
cmp dword [eax + 4], 0
jne 0x5af8e9
xor eax, eax
jmp 0x5af941
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x20c]
push edx
call fcn.005af590
add esp, 8
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x5af929
lea edx, [ebp - 0x20c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x6a7538
mov edx, dword [ebp - 0x210]
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 8

Function at 0x5b03e0
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x80
lea ecx, [ebp + 8]
call fcn.0040d3c0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp + 8]
call fcn.0040d3c0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0x10
je 0x5b04cf
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0063a460
add esp, 0xc
lea ecx, [ebp + 8]
call fcn.0040d3c0
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0064244e
add esp, 8
xor edx, edx
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x220], edx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x218], edx
mov dword [ebp - 0x214], edx
mov word [ebp - 0x210], dx
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 3
mov eax, 0x414
mov word [ebp - 0x21c], ax
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x212], 0
lea edx, [ebp - 0x22c]
push edx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
jmp 0x5b04de
lea ecx, [ebp + 8]
call fcn.0040d3c0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp + 8]
call fcn.00413870
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret

Function at 0x5b0540
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x5b054d
xor eax, eax
jmp 0x5b0572
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x5b055f
xor eax, eax
jmp 0x5b0572
mov ecx, dword [ebp + 8]
push ecx
call fcn.00603960
add esp, 4
jmp 0x5b0572
pop ebp
ret
Function at 0x5b0d10
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0063a460
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Fontsmsyh.ttf
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret

Function at 0x5b0d80
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 0xffff
movzx ecx, ax
and ecx, 0xff
movzx edx, cl
mov dword [ebp - 8], edx
cmp dword [ebp - 4], 0x80000000
jae 0x5b0db9
cmp dword [ebp - 8], 6
jb 0x5b0db9
mov al, 1
jmp 0x5b0dbb
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x5b4430
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x190], ecx
mov eax, dword [ebp - 0x190]
cmp dword [eax + 0xa0], 0
jne 0x5b445d
jmp 0x5b460f
mov ecx, dword [ebp - 0x190]
cmp dword [ecx + 0xe8], 0
jne 0x5b4471
jmp 0x5b460f
mov ecx, dword [ebp - 0x190]
add ecx, 0xec
call fcn.00425070
movzx edx, al
test edx, edx
je 0x5b448e
jmp 0x5b460f
lea ecx, [ebp - 0x19c]
call fcn.00413220
call fcn.005e2270
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0
je 0x5b45a7
mov eax, dword [ebp - 0x190]
cvtsi2sd xmm0, dword [eax + 0xe8]
sub esp, 8
movsd qword [esp], xmm0
call fcn.005e2210
add esp, 8
push eax
push 0x6a9a80
mov ecx, dword [ebp - 0x194]
push ecx
call fcn.005e2130
add esp, 0xc
push 0xfde9
mov ecx, dword [ebp - 0x190]
add ecx, 0xec
call fcn.00424f40
push eax
lea ecx, [ebp - 0x88]
call fcn.00421730
mov ecx, eax
call fcn.0040d3c0
push eax
call fcn.005e22a0
add esp, 4
push eax
push str.detail
mov edx, dword [ebp - 0x194]
push edx
call fcn.005e2130
add esp, 0xc
lea ecx, [ebp - 0x88]
call fcn.00421ba0
mov eax, dword [ebp - 0x194]
push eax
call fcn.005e2520
add esp, 4
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0
je 0x5b4598
push 0xfde9
mov ecx, dword [ebp - 0x198]
push ecx
lea ecx, [ebp - 0x18c]
call fcn.004214f0
mov ecx, eax
call fcn.0040d3c0
push eax
lea ecx, [ebp - 0x19c]
call fcn.00413a70
lea ecx, [ebp - 0x18c]
call fcn.00421ba0
mov edx, dword [ebp - 0x198]
push edx
call fcn.0063e41a
add esp, 4
mov eax, dword [ebp - 0x194]
push eax
call fcn.005e2350
add esp, 4
lea ecx, [ebp - 0x19c]
call fcn.0040d3c0
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 0x1a0], 0
sub esp, 0x28
mov ecx, esp
push 0
call fcn.00421a10
lea ecx, [ebp - 0x1a0]
push ecx
push 1
lea edx, [ebp - 0x1a4]
push edx
push str.show_detail
mov ecx, dword [ebp - 0x190]
add ecx, 0x8c
call fcn.005d2470
mov eax, dword [ebp - 0x190]
mov dword [eax + 0xe8], 0
lea ecx, [ebp - 0x19c]
call fcn.00413870
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret
Function at 0x5bccc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x1d8], ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x1ec]
call fcn.00614c60
lea ecx, [ebp - 0x4c]
call fcn.004219f0
lea ecx, [ebp - 0x34]
call fcn.004219f0
lea ecx, [ebp - 0x1c]
call fcn.004219f0
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x1ec]
call fcn.00614e70
lea edx, [ebp - 0x34]
push edx
lea ecx, [ebp - 0x1ec]
call fcn.00614e70
mov eax, dword [ebp - 0x1d8]
add eax, 0xc8
push eax
lea ecx, [ebp - 0x1ec]
call fcn.00614e70
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x1ec]
call fcn.00614e70
mov edx, dword [ebp - 0x1d8]
cmp dword [edx + 0xa0], 0
jne 0x5bcd71
lea ecx, [ebp - 0x1c]
call fcn.00421c50
lea ecx, [ebp - 0x34]
call fcn.00421c50
lea ecx, [ebp - 0x4c]
call fcn.00421c50
jmp 0x5bcf4e
lea ecx, [ebp - 0x1e4]
call fcn.00413220
call fcn.005e2270
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0
je 0x5bce57
push 0xfde9
mov ecx, dword [ebp - 0x1d8]
add ecx, 0xc8
call fcn.00424f40
push eax
lea ecx, [ebp - 0xd0]
call fcn.00421730
mov ecx, eax
call fcn.0040d3c0
push eax
call fcn.005e22a0
add esp, 4
push eax
push 0x6aa9d8
mov eax, dword [ebp - 0x1dc]
push eax
call fcn.005e2130
add esp, 0xc
lea ecx, [ebp - 0xd0]
call fcn.00421ba0
mov ecx, dword [ebp - 0x1dc]
push ecx
call fcn.005e2520
add esp, 4
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0
je 0x5bce48
push 0xfde9
mov edx, dword [ebp - 0x1e0]
push edx
lea ecx, [ebp - 0x1d4]
call fcn.004214f0
mov ecx, eax
call fcn.0040d3c0
push eax
lea ecx, [ebp - 0x1e4]
call fcn.00413a70
lea ecx, [ebp - 0x1d4]
call fcn.00421ba0
mov eax, dword [ebp - 0x1e0]
push eax
call fcn.0063e41a
add esp, 4
mov ecx, dword [ebp - 0x1dc]
push ecx
call fcn.005e2350
add esp, 4
mov ecx, dword [ebp - 0x1d8]
add ecx, 0xc8
call fcn.00425070
movzx edx, al
test edx, edx
jne 0x5bcf1e
lea ecx, [ebp - 0x1e4]
call fcn.0040d3c0
mov dword [ebp - 0x1f8], eax
mov dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x1f0], eax
mov dword [ebp - 0x200], 0x5bcbb0
mov dword [ebp - 0x1fc], 0
mov ecx, dword [ebp - 0x200]
mov dword [ebp - 0x208], ecx
mov edx, dword [ebp - 0x1fc]
mov dword [ebp - 0x204], edx
sub esp, 0x28
mov esi, esp
sub esp, 0x10
mov eax, esp
push 0x6aa631
push 0x6aa630
lea ecx, [ebp - 0x1f0]
push ecx
lea edx, [ebp - 0x208]
push edx
push eax
call fcn.00420f50
add esp, 0x14
mov ecx, esi
call fcn.005bd0b0
lea eax, [ebp - 0x1f4]
push eax
push 1
lea ecx, [ebp - 0x1f8]
push ecx
push str.login
mov ecx, dword [ebp - 0x1d8]
add ecx, 0x8c
call fcn.005d2470
push 0x6aa9f0
call fcn.005564a0
add esp, 4
lea ecx, [ebp - 0x1e4]
call fcn.00413870
lea ecx, [ebp - 0x1c]
call fcn.00421c50
lea ecx, [ebp - 0x34]
call fcn.00421c50
lea ecx, [ebp - 0x4c]
call fcn.00421c50
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 4
Function at 0x5bd820
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x60]
call fcn.00614c60
lea ecx, [ebp - 0x34]
call fcn.004219f0
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x60]
call fcn.00614e70
lea ecx, [ebp - 0x1c]
call fcn.004219f0
lea edx, [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x60]
call fcn.00614e70
lea ecx, [ebp - 0x1c]
call fcn.00424f40
push eax
lea ecx, [ebp - 0x3c]
call fcn.004131e0
push ecx
mov ecx, esp
lea eax, [ebp - 0x3c]
push eax
call fcn.00421650
lea ecx, [ebp - 0x58]
push ecx
mov ecx, dword [ebp - 0x38]
call fcn.005bda40
push eax
mov ecx, dword [ebp - 0x38]
add ecx, 0x10
call fcn.0040d360
lea ecx, [ebp - 0x58]
call fcn.00413870
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
push 0x6aae58
call fcn.005564a0
add esp, 0xc
mov ecx, dword [ebp - 0x38]
add ecx, 0x10
call fcn.0040d3c0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x5bd8e4
mov ecx, dword [ebp - 0x38]
add ecx, 0x10
call fcn.0040dd70
movzx edx, al
test edx, edx
je 0x5bd916
mov ecx, dword [ebp - 0x38]
call fcn.005bdbf0
push str.DownloadImgTask_NotifyHeadPath
call fcn.005564a0
add esp, 4
lea ecx, [ebp - 0x3c]
call fcn.00413870
lea ecx, [ebp - 0x1c]
call fcn.00421c50
lea ecx, [ebp - 0x34]
call fcn.00421c50
jmp 0x5bd9de
call fcn.00431970
mov ecx, eax
call fcn.00540040
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x5bd9c6
movzx eax, byte [ebp - 0x3d]
push eax
mov ecx, dword [ebp - 0x44]
push ecx
mov ecx, dword [ebp - 0x38]
add ecx, 8
call fcn.004315a0
cmp dword [ebp - 0x38], 0
je 0x5bd954
mov edx, dword [ebp - 0x38]
add edx, 4
mov dword [ebp - 0x48], edx
jmp 0x5bd95b
mov dword [ebp - 0x48], 0
mov ecx, dword [ebp - 0x38]
add ecx, 8
call fcn.00431280
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [edx]
call eax
mov ecx, dword [ebp - 0x38]
add ecx, 8
call fcn.00431280
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x38]
add ecx, 0x10
call fcn.0040d3c0
push eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x28]
call eax
mov ecx, dword [ebp - 0x38]
add ecx, 8
call fcn.00431280
mov dword [ebp - 0x54], eax
lea ecx, [ebp - 0x3c]
call fcn.0040d3c0
push eax
push 0
mov ecx, dword [ebp - 0x54]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x54]
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x3c]
call fcn.00413870
lea ecx, [ebp - 0x1c]
call fcn.00421c50
lea ecx, [ebp - 0x34]
call fcn.00421c50
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 4
Function at 0x5bda40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2b8], ecx
lea ecx, [ebp + 0xc]
call fcn.0040dd70
movzx eax, al
test eax, eax
je 0x5bda85
push 0x6aaf74
mov ecx, dword [ebp + 8]
call fcn.004131e0
lea ecx, [ebp + 0xc]
call fcn.00413870
mov eax, dword [ebp + 8]
jmp 0x5bdbd4
push 0xfde9
lea ecx, [ebp + 0xc]
call fcn.0040d3c0
push eax
lea ecx, [ebp - 0x2a8]
call fcn.00421730
mov ecx, eax
call fcn.0040d3c0
push eax
lea ecx, [ebp - 0x224]
call fcn.00421970
lea ecx, [ebp - 0x2a8]
call fcn.00421ba0
lea ecx, [ebp - 0x2b0]
call fcn.00413220
push 0x21
push 0x21
lea ecx, [ebp - 0x2b0]
call fcn.004e2ab0
push eax
lea ecx, [ebp - 0x224]
call fcn.00425220
push eax
lea ecx, [ebp - 0x224]
call fcn.00424f20
push eax
call fcn.005e9440
add esp, 0x10
push 0xffffffffffffffff
lea ecx, [ebp - 0x2b0]
call fcn.004c9de0
push 0x2e
lea ecx, [ebp + 0xc]
call fcn.004237d0
mov dword [ebp - 0x2bc], eax
push 0x6aaf78
lea ecx, [ebp - 0x2b4]
call fcn.004131e0
lea ecx, [ebp - 0x2b4]
push ecx
lea ecx, [ebp - 0x2b0]
call fcn.00422560
push 0x208
push 0
lea edx, [ebp - 0x20c]
push edx
call fcn.0063a460
add esp, 0xc
push 0
push 0x1a
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor ecx, ecx
mov byte [ebp - 0x2a9], cl
lea ecx, [ebp - 0x2a9]
call fcn.005bdea0
push eax
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x2b0]
call fcn.0040d3c0
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004131e0
lea ecx, [ebp - 0x2b4]
call fcn.00413870
lea ecx, [ebp - 0x2b0]
call fcn.00413870
lea ecx, [ebp - 0x224]
call fcn.00421c30
lea ecx, [ebp + 0xc]
call fcn.00413870
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 8
Function at 0x5be3a0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x10], 4
xor eax, eax
mov byte [ebp - 1], al
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x14]
push eax
push 0x6ab284
lea ecx, [ebp - 1]
call fcn.005c46f0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0xc], 1
je 0x5be3f3
jmp 0x5be476
call fcn.004be550
test eax, eax
je 0x5be43a
push 1
mov ecx, dword [ebp - 8]
call fcn.005bf3f0
test eax, eax
je 0x5be438
mov ecx, dword [ebp - 8]
call fcn.005bed70
mov ecx, dword [ebp - 8]
call fcn.005bf760
xor ecx, ecx
mov byte [ebp - 2], cl
push 0x6ab294
lea ecx, [ebp - 2]
call fcn.005c5760
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
jmp 0x5be476
push 1
mov ecx, dword [ebp - 8]
call fcn.005bf100
test eax, eax
je 0x5be476
mov ecx, dword [ebp - 8]
call fcn.005bea00
mov ecx, dword [ebp - 8]
call fcn.005bf870
xor edx, edx
mov byte [ebp - 3], dl
push str.Switch
lea ecx, [ebp - 3]
call fcn.005c5bc0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov esp, ebp
pop ebp
ret

Function at 0x5be7a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], 1
mov dword [ebp - 0x214], 0x104
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0063a460
add esp, 0xc
xor ecx, ecx
mov byte [ebp - 0x20d], cl
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0x6aafa0
lea ecx, [ebp - 0x20d]
call fcn.005c5b70
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 0x220], eax
push 0x6aafb8
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x5be83a
jmp 0x5be8b3
cmp dword [ebp - 0x220], 0
jne 0x5be850
mov ecx, dword [ebp - 0x21c]
call fcn.005bea00
jmp 0x5be8b3
mov dword [ebp - 0x218], 1
mov dword [ebp - 0x214], 0x104
xor eax, eax
mov byte [ebp - 0x20e], al
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x218]
push eax
push 0
lea ecx, [ebp - 0x20e]
call fcn.005c9b60
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x5be8a0
jmp 0x5be8b3
mov ecx, dword [ebp - 0x21c]
call fcn.005bea00
xor ecx, ecx
jne 0x5be7b9
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret
Function at 0x5be8d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], 1
mov dword [ebp - 0x214], 0x104
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0063a460
add esp, 0xc
xor ecx, ecx
mov byte [ebp - 0x20d], cl
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0x6aafd0
lea ecx, [ebp - 0x20d]
call fcn.005c9490
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 0x220], eax
push str.birdwallpaper.ico
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x5be96a
jmp 0x5be9e3
cmp dword [ebp - 0x220], 0
jne 0x5be980
mov ecx, dword [ebp - 0x21c]
call fcn.005bed70
jmp 0x5be9e3
mov dword [ebp - 0x218], 1
mov dword [ebp - 0x214], 0x104
xor eax, eax
mov byte [ebp - 0x20e], al
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x218]
push eax
push 0
lea ecx, [ebp - 0x20e]
call fcn.005c5c60
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x5be9d0
jmp 0x5be9e3
mov ecx, dword [ebp - 0x21c]
call fcn.005bed70
xor ecx, ecx
jne 0x5be8e9
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret
Function at 0x5bf760
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x41c], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0063a460
add esp, 0xc
push 1
push 0x19
lea ecx, [ebp - 0x20c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor edx, edx
mov byte [ebp - 0x415], dl
lea ecx, [ebp - 0x415]
call fcn.005c7840
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5bf7e1
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x208
push 0
lea eax, [ebp - 0x414]
push eax
call fcn.0063a460
add esp, 0xc
push 1
push 0x17
lea ecx, [ebp - 0x414]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor edx, edx
mov byte [ebp - 0x416], dl
lea ecx, [ebp - 0x416]
call fcn.005c5b20
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5bf84e
lea edx, [ebp - 0x414]
push edx
mov ecx, dword [ebp - 0x41c]
call fcn.005bf9d0
push 0
push 0
push 0x1000
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret
Function at 0x5bf870
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x424], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0063a460
add esp, 0xc
push 1
push 0x19
lea ecx, [ebp - 0x20c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x6ab540
lea edx, [ebp - 0x420]
push edx
call fcn.004bd3f0
add esp, 4
mov ecx, eax
call fcn.00422730
test eax, eax
jne 0x5bf8dd
mov dword [ebp - 0x41c], 1
jmp 0x5bf8e7
mov dword [ebp - 0x41c], 0
mov al, byte [ebp - 0x41c]
mov byte [ebp - 0x415], al
lea ecx, [ebp - 0x420]
call fcn.00413870
movzx ecx, byte [ebp - 0x415]
test ecx, ecx
je 0x5bf91d
push 0x6ab554
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
jmp 0x5bf92f
push 0x6ab574
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5bf94d
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x208
push 0
lea eax, [ebp - 0x414]
push eax
call fcn.0063a460
add esp, 0xc
push 1
push 0x17
lea ecx, [ebp - 0x414]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x6ab58c
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5bf9ab
lea ecx, [ebp - 0x414]
push ecx
mov ecx, dword [ebp - 0x424]
call fcn.005bf9d0
push 0
push 0
push 0x1000
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret
Function at 0x5bf9d0
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88c
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x888], ecx
cmp dword [ebp + 8], 0
jne 0x5bf9f6
xor eax, eax
jmp 0x5bfb59
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x5bfa07
xor eax, eax
jmp 0x5bfb59
mov edx, dword [ebp + 8]
push edx
call fcn.00641e0e
add esp, 4
mov dword [ebp - 0x884], eax
cmp dword [ebp - 0x884], 0x104
jl 0x5bfa2c
xor eax, eax
jmp 0x5bfb59
push 0x410
push 0
lea eax, [ebp - 0x414]
push eax
call fcn.0063a460
add esp, 0xc
push 0x6ab59c
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x878]
call fcn.005c45d0
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x878]
call fcn.005ca010
mov dword [ebp - 0x880], eax
cmp dword [ebp - 0x880], 0
je 0x5bfb29
lea ecx, [ebp - 0x878]
call fcn.005ca300
test eax, eax
je 0x5bfaaa
lea ecx, [ebp - 0x878]
call fcn.005ca170
mov dword [ebp - 0x880], eax
jmp 0x5bfa7b
lea ecx, [ebp - 0x87c]
push ecx
lea ecx, [ebp - 0x878]
call fcn.005ca220
lea ecx, [ebp - 0x878]
call fcn.005ca2e0
test eax, eax
je 0x5bfaf6
lea ecx, [ebp - 0x87c]
call fcn.0040d3c0
push eax
mov ecx, dword [ebp - 0x888]
call fcn.005bf9d0
lea ecx, [ebp - 0x87c]
call fcn.0040d3c0
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x5bfb08
lea ecx, [ebp - 0x87c]
call fcn.0040d3c0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x878]
call fcn.005ca170
mov dword [ebp - 0x880], eax
lea ecx, [ebp - 0x87c]
call fcn.00413870
jmp 0x5bfa7b
lea ecx, [ebp - 0x878]
call fcn.005c9fc0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [ebp - 0x88c], 1
lea ecx, [ebp - 0x878]
call fcn.005c4610
mov eax, dword [ebp - 0x88c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 4