joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409c70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48889b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x88
push esi
push edi
push 4
call fcn.00434772
lea eax, [ebp - 0x94]
push eax
call fcn.00434684
add esp, 8
mov dword [ebp - 4], 0
call fcn.0043477f
dec eax
cmp eax, 3
ja case.default.0x409cbc
jmp dword [eax*4 + 0x409e40]
push str.Res_skin_uninst_
lea ecx, [ebp - 0x94]
call fcn.004315b0
lea ecx, [ebp - 0x94]
call fcn.0043153d
push eax
call fcn.0043472b
add esp, 4
jmp case.default.0x409cbc
push str.Res_skin_uninst_
lea ecx, [ebp - 0x94]
call fcn.004315b0
lea ecx, [ebp - 0x94]
call fcn.0043153d
push eax
call fcn.0043472b
add esp, 4
push 0x4a15ac
push ecx
mov eax, esp
mov dword [ebp - 0x10], esp
mov dword [eax], str.IDR_RES
call fcn.00409be0
mov ecx, eax
call fcn.0043e8bf
jmp case.default.0x409cbc
push str.Res_skin_uninst_
lea ecx, [ebp - 0x94]
call fcn.004315b0
lea ecx, [ebp - 0x94]
call fcn.0043153d
push eax
call fcn.0043472b
push str.skin_uninst
push 1
push str.skin_uninst.zip
call fcn.0043726a
add esp, 0x10
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x10], esp
mov dword [eax], str.res.xml
call fcn.00409be0
mov ecx, eax
call fcn.0043e8bf
jmp case.default.0x409cbc
push str.Res_skin_uninst_
lea ecx, [ebp - 0x94]
call fcn.004315b0
lea ecx, [ebp - 0x94]
call fcn.0043153d
push eax
call fcn.0043472b
add esp, 4
push str.ZIPRES
push 0x68
call fcn.004346f1
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je case.default.0x409cbc
push esi
call fcn.004346f1
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x409e14
push esi
call fcn.004346f1
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x409e14
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call fcn.004371dc
add esp, 0xc
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x10], esp
mov dword [eax], str.res.xml
call fcn.00409be0
mov ecx, eax
call fcn.0043e8bf
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
call fcn.004313e9
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x409e50
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push str.3uToolsUnInstaller
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp + 8]
push eax
call fcn.0043471e
add esp, 4
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test edi, edi
je 0x409f1d
test esi, esi
jne 0x409f1d
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x409f1d
call fcn.00409c70
push 0x938
call fcn.0041af51
add esp, 4
test eax, eax
je 0x409f1d
push eax
call fcn.00406b20
mov esi, eax
test esi, esi
je 0x409f1d
push 0
push 0x190
push 0x1f4
push 0
push 0
push 0x60000
push 0x10cf0000
push str.3uToolsUnInstaller
push 0
mov ecx, esi
call fcn.00430fe1
mov ecx, esi
call fcn.00430abb
push 5
mov ecx, esi
call fcn.00430971
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0043b340
call dword [sym.imp.ole32.dll_CoUninitialize]
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x409f50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x409f68
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x409f9a
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x409f96
cmp esi, eax
jae 0x409f9a
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x409f88
cmp esi, eax
jb 0x409fa0
pop esi
xor eax, eax
pop edi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x40a490
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push esi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x40a4ce
lea eax, [ebp - 0x22c]
push eax
push esi
mov dword [ebp - 0x22c], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x40a4d5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
lea esp, [esp]
lea ecx, [ebp - 0x208]
push ecx
push ebx
call fcn.0041b0d4
add esp, 8
test eax, eax
je 0x40a511
lea edx, [ebp - 0x22c]
push edx
push esi
call edi
test eax, eax
jne 0x40a4e0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x224]
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx], eax
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40a530
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push esi
mov esi, eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x212]
push ecx
mov word [ebp - 0x214], ax
call fcn.00420e90
mov edx, dword [ebp + 8]
push esi
push edx
push str._s_s
lea edx, [ebp - 0x214]
mov dword [ebp - 8], 0xffffffff
call fcn.00408780
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x214]
push ecx
mov eax, esi
call fcn.0040a5d0
add esp, 0x20
test eax, eax
je 0x40a5c3
mov eax, dword [ebp - 8]
test eax, eax
je 0x40a5c3
push eax
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40a5bc
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0xfa0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40a5d0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x65c
push ebx
push esi
push edi
push 0
push 2
mov edi, eax
or ebx, 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x40a6fd
lea eax, [esp + 0x10]
push eax
push esi
mov dword [esp + 0x18], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x40a621
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x34]
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40a64d
test dx, dx
je 0x40a649
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40a64d
add eax, 4
add ecx, 4
test dx, dx
jne 0x40a627
xor eax, eax
jmp 0x40a652
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40a65a
mov ebx, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40a621
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x40a6fd
lea edx, [esp + 0x240]
push edx
push esi
mov dword [esp + 0x248], 0x428
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x40a6fa
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x460]
jmp 0x40a6b0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40a6d6
test dx, dx
je 0x40a6d2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40a6d6
add eax, 4
add ecx, 4
test dx, dx
jne 0x40a6b0
xor eax, eax
jmp 0x40a6db
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40a6fa
mov eax, dword [esp + 0x248]
mov ecx, dword [ebp + 0xc]
push esi
mov dword [ecx], eax
call edi
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40bde0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.00420e90
add esp, 0xc
mov ecx, 0x4b4520
call fcn.0043153d
lea edx, [ebp - 0x20c]
sub edx, eax
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x40be20
lea edx, [ebp - 4]
push edx
push 0xf003f
push 0
lea eax, [ebp - 0x20c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40be76
lea ecx, [ebp - 0x20c]
push ecx
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
je 0x40be6c
xor al, al
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x40c1f0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x488b26
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x314
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x31e]
push ecx
mov word [ebp - 0x320], ax
call fcn.00420e90
add esp, 0xc
xor eax, eax
mov edi, edi
movzx ecx, word [eax + str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_]
mov word [ebp + eax - 0x320], cx
add eax, 2
test cx, cx
jne 0x40c230
push 0x4a25ec
lea edx, [ebp - 0x118]
push edx
mov ecx, 0x4b46b8
call fcn.00431879
push 0x4b3db0
lea ecx, [ebp - 0x94]
push ecx
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00431850
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0043153d
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40c284
push esi
push edi
lea edi, [ebp - 0x320]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x40c2a0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0
call fcn.004313e9
lea ecx, [ebp - 0x118]
mov dword [ebp - 4], 0xffffffff
call fcn.004313e9
call fcn.0040b640
lea edx, [ebp - 0x10]
push edx
push 0xf023f
mov esi, eax
push 0
lea eax, [ebp - 0x320]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40c389
test esi, esi
je 0x40c321
lea ecx, [ebp - 0x320]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
jmp 0x40c369
mov edx, dword [ebp - 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x4a25f0
push edx
call esi
mov eax, dword [ebp - 0x10]
push str.DisplayName
push eax
call esi
mov ecx, dword [ebp - 0x10]
push 0x4a2620
push ecx
call esi
mov edx, dword [ebp - 0x10]
push str.Publisher
push edx
call esi
mov eax, dword [ebp - 0x10]
push str.UninstallString
push eax
call esi
mov ecx, dword [ebp - 0x10]
push str.URLInfoAbout
push ecx
call esi
test eax, eax
je 0x40c37f
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
pop edi
mov al, 1
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40c3a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x212]
push ecx
mov word [ebp - 0x214], ax
call fcn.00420e90
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x41a]
push eax
mov word [ebp - 0x41c], dx
call fcn.00420e90
add esp, 0x18
push 0x4a2564
mov edx, SysReAllocString
mov eax, 0x82
lea ecx, [ebp - 0x214]
call fcn.0040bc60
mov ecx, 0x4b48d8
call fcn.0043153d
mov edx, 0x82
lea ecx, [ebp - 0x214]
cmp word [ecx], 0
je 0x40c41f
add ecx, 2
dec edx
jne 0x40c411
jmp 0x40c443
test edx, edx
je 0x40c443
push eax
mov ecx, 0x82
sub ecx, edx
mov eax, 0x82
sub eax, ecx
lea ecx, [ebp + ecx*2 - 0x214]
mov edx, SysReAllocString
call fcn.0040bc60
push ebx
push esi
push edi
push 0
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
lea edx, [ebp - 0x214]
push edx
push reloc.gdiplus.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 0xc]
mov edi, eax
je 0x40c4da
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x41c]
push ecx
lea edx, [ebp - 4]
push edx
push 0
push str.Guid
push edi
mov dword [ebp - 8], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40c4aa
mov esi, 1
cmp dword [ebp - 4], esi
je 0x40c4ae
xor esi, esi
jmp 0x40c4dd
lea eax, [ebp - 0x41c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40c4b7
sub eax, edx
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x41c]
sar eax, 1
push ecx
push edx
mov ebx, eax
call fcn.0040a880
jmp 0x40c4dd
mov esi, dword [ebp + 8]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jne 0x40c601
push 0x208
lea ecx, [ebp - 0x214]
push 0
push ecx
call fcn.00420e90
push 0x208
lea edx, [ebp - 0x41c]
push 0
push edx
call fcn.00420e90
add esp, 0x18
push 0x4a2564
mov edx, SysReAllocString
mov eax, 0x82
lea ecx, [ebp - 0x214]
call fcn.0040bc60
mov edx, 0x82
lea eax, [ebp - 0x214]
cmp word [eax], 0
je 0x40c54f
add eax, 2
dec edx
jne 0x40c541
jmp 0x40c577
test edx, edx
je 0x40c577
mov ecx, 0x82
sub ecx, edx
mov eax, 0x82
sub eax, ecx
push str.3uTools
lea ecx, [ebp + ecx*2 - 0x214]
mov edx, SysReAllocString
call fcn.0040bc60
push 0
lea eax, [ebp + 8]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
lea ecx, [ebp - 0x214]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
neg eax
sbb eax, eax
not eax
and eax, dword [ebp + 8]
mov ebx, eax
je 0x40c5fa
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x41c]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push str.Guid
push ebx
mov dword [ebp - 4], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40c5db
mov esi, 1
cmp dword [ebp - 8], esi
je 0x40c5ef
push ebx
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea edx, [ebp - 0x41c]
call fcn.0040a730
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40d0b0
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x412]
push ecx
mov dword [ebp - 4], 0
mov word [ebp - 0x414], ax
call fcn.00420e90
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x61a]
push eax
mov word [ebp - 0x61c], dx
call fcn.00420e90
push str.PlistEditor.plist
push str._sDefaultIcon
lea edx, [ebp - 0x20c]
call fcn.00408780
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
add esp, 0x20
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x20c]
push edx
push SysReAllocString
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueW]
test eax, eax
jne 0x40d165
lea eax, [ebp - 0x414]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d140
mov ecx, dword [ebp - 4]
sub eax, edx
sar eax, 1
inc eax
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push 0x4a15a8
push ecx
call ebx
mov edx, dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
push str.PlistEditor.plist
push str._s_shell
lea edx, [ebp - 0x20c]
call fcn.00408780
add esp, 8
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x40d1d5
lea eax, [ebp - 0x61c]
lea edx, [eax + 2]
jmp 0x40d1b0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d1b0
sub eax, edx
sar eax, 1
inc eax
push eax
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x61c]
push edx
push 1
push 0x4a15a8
push eax
call ebx
mov ecx, dword [ebp - 4]
push ecx
call esi
push str.3uTools
push str.PlistEditor.plist
push str._s_shell_s
lea edx, [ebp - 0x20c]
call fcn.00408780
add esp, 0xc
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x20c]
push eax
push SysReAllocString
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x40d21f
mov ecx, dword [ebp - 4]
push str.command
push ecx
call ebx
mov edx, dword [ebp - 4]
push edx
call esi
push str.PlistEditor.plist
push str._s_shell_
lea edx, [ebp - 0x20c]
call fcn.00408780
add esp, 8
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x40d25e
mov edx, dword [ebp - 4]
push str.3uTools
push edx
call ebx
mov eax, dword [ebp - 4]
push eax
call esi
push 0
push 0
push 0x3000
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40d290
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, eax
lea eax, [ebp - 4]
push eax
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x40d2eb
mov ecx, dword [ebp - 4]
push ebx
push esi
push edi
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov ebx, eax
add edi, 0xfffffffe
jmp 0x40d2c0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40d2c0
mov edx, dword [ebp - 4]
mov ecx, 0x15
mov esi, str.MicrosoftInternet_ExplorerQuick_Launch
push edx
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
pop esi
mov eax, ebx
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40d460
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x488afb
push eax
mov dword fs:[0], esp
sub esp, 0x6f4
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x40d6d3
xor eax, eax
cmp ax, word [esi]
je 0x40d6d3
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40d6d3
push 0x24c
lea ecx, [ebp - 0x6f8]
push 0
push ecx
mov dword [ebp - 0x6fc], 0
call fcn.00420e90
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x2a2]
push eax
mov word [ebp - 0x2a4], dx
call fcn.00420e90
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x4aa]
push edx
mov word [ebp - 0x4ac], cx
call fcn.00420e90
add esp, 0xc
push esi
lea eax, [ebp - 0x4ac]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [esi + eax*2 - 2], 0x5c
je 0x40d53b
push esi
push 0x4a28a4
lea ecx, [ebp - 0x4ac]
push 0x103
push ecx
call fcn.0041bb2a
add esp, 0x10
jmp 0x40d550
push 0x103
lea edx, [ebp - 0x4ac]
push esi
push edx
call fcn.0041bbfa
add esp, 0xc
lea eax, [ebp - 0x4ac]
push eax
push str._s.
lea ecx, [ebp - 0x2a4]
push 0x103
push ecx
call fcn.0041bb2a
add esp, 0x10
lea edx, [ebp - 0x6fc]
push edx
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40d6d3
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x40d5a0
push 0x4a28b8
lea ecx, [ebp - 0x6d0]
push ecx
call esi
test eax, eax
je 0x40d693
push 0x4a28bc
lea edx, [ebp - 0x6d0]
push edx
call esi
test eax, eax
je 0x40d693
lea eax, [ebp - 0x6d0]
push eax
lea ecx, [ebp - 0x4ac]
push ecx
push str._s_s
lea edx, [ebp - 0x2a4]
push 0x103
push edx
call fcn.0041bb2a
add esp, 0x14
test byte [ebp - 0x6fc], 0x10
je 0x40d610
lea eax, [ebp - 0x2a4]
push eax
call fcn.0040d460
add esp, 4
jmp 0x40d693
push 0xffffffffffffffff
lea ecx, [ebp - 0x2a4]
push ecx
lea ecx, [ebp - 0x9c]
call fcn.00431807
lea ecx, [ebp - 0x9c]
mov dword [ebp - 4], 0
call fcn.0043153d
push eax
call fcn.0040d390
add esp, 4
lea edx, [ebp - 0x2a4]
push edx
call edi
test eax, eax
jne 0x40d655
lea eax, [ebp - 0x2a4]
push eax
call edi
fld dword [0x4a3100]
fld dword [0x4b22f0]
fcom st(1)
fnstsw ax
test ah, 5
jp 0x40d674
fstp st(1)
fadd qword [0x4a30f8]
jmp 0x40d676
fstp st(0)
fstp dword [0x4b22f0]
call fcn.0040d410
lea ecx, [ebp - 0x9c]
mov dword [ebp - 4], 0xffffffff
call fcn.004313e9
lea ecx, [ebp - 0x6fc]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40d5a0
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [ebp - 0x4ac]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415430
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x488acb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4ae3bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00482d55
push 4
mov dword [ebp - 4], 0
call fcn.0041af51
mov edi, eax
add esp, 4
test edi, edi
je 0x4154ac
call fcn.00419487
mov dword [edi], eax
call fcn.00419246
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0041964d
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4154a2
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.00419675
jmp 0x4154ae
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41cbf1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4ae3bc]
jne 0x41cbfb
repz ret
jmp fcn.00426d9c