joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404210
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], 0
mov esi, dword [edi + 8]
test esi, esi
je 0x404281
cmp dword [esi], 0
je 0x404274
push 0x4da004
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x404247
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40427a
push 0
push dword [esi]
lea ecx, [ebp - 4]
push ecx
push 0x2001f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call eax
jmp 0x40429c
cmp dword [esi + 4], 0
jne 0x404281
mov eax, 1
jmp 0x40429c
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4042bf
mov eax, dword [edi]
xor edx, edx
test eax, eax
je 0x4042b1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, eax
mov ecx, dword [ebp - 4]
mov eax, edx
mov dword [edi], ecx
mov dword [edi + 4], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x404670
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x344
mov eax, dword [0x5023a4]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x32c]
push eax
mov dword [ebp - 0x32c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x328], 6
jb 0x4046b6
push edi
call fcn.00405f20
test eax, eax
jne 0x404797
sub esp, 0xc
mov dword [ebp - 0x340], 0
lea ecx, [ebp - 0x340]
mov dword [ebp - 0x33c], 0
mov dword [ebp - 0x338], 0
call fcn.00404210
mov esi, dword [ebp - 0x340]
test eax, eax
jne 0x40478a
push 0x208
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.0049b560
add esp, 0xc
mov dword [ebp - 0x330], 0x208
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x334]
push eax
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40478a
mov eax, dword [ebp - 0x334]
cmp eax, 1
je 0x404743
cmp eax, 2
jne 0x40478a
mov eax, dword [ebp - 0x330]
test eax, eax
je 0x40478a
test al, 1
jne 0x40478a
shr eax, 1
cmp word [ebp + eax*2 - 0x216], 0
jne 0x40478a
cmp word [ebp - 0x214], 0
je 0x40478a
test esi, esi
je 0x404773
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0049765c
mov esp, ebp
pop ebp
ret 4
test esi, esi
je 0x404795
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.0049765c
mov esp, ebp
pop ebp
ret 4
Function at 0x406220
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp word [0x505f18], 0
jne 0x406244
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x100
push eax
push 0x505f18
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
call fcn.004031c0
mov ecx, eax
test ecx, ecx
je 0x40629a
mov eax, dword [ecx]
push esi
call dword [eax + 0xc]
mov esi, dword [ebp + 8]
add eax, 0x10
push 0x505f18
mov ecx, esi
mov dword [esi], eax
call fcn.004034f0
test al, al
jne 0x406291
mov ecx, 0x505f18
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406275
sub ecx, edx
sar ecx, 1
push ecx
push 0x505f18
mov ecx, esi
call fcn.00403760
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00402f10
int3

Function at 0x4062b0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp word [0x506118], 0
jne 0x4062d6
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x100
push eax
push 0x506118
push 2
call dword [sym.imp.Secur32.dll_GetUserNameExW]
call fcn.004031c0
mov ecx, eax
test ecx, ecx
je 0x40632c
mov eax, dword [ecx]
push esi
call dword [eax + 0xc]
mov esi, dword [ebp + 8]
add eax, 0x10
push 0x506118
mov ecx, esi
mov dword [esi], eax
call fcn.004034f0
test al, al
jne 0x406323
mov ecx, 0x506118
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406307
sub ecx, edx
sar ecx, 1
push ecx
push 0x506118
mov ecx, esi
call fcn.00403760
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00402f10
int3
Function at 0x40a160
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
cmp dword [0x506568], 0
push esi
jne 0x40a18f
push 0x20d0
call fcn.0049786c
add esp, 4
mov ecx, eax
call fcn.00414c70
mov ecx, eax
mov dword [0x506568], eax
mov edx, dword [eax]
call dword [edx]
call fcn.004031c0
mov ecx, eax
test ecx, ecx
je 0x40a223
mov eax, dword [ecx]
call dword [eax + 0xc]
push dword [ebp + 8]
add eax, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push str._s__main
push eax
call fcn.004040c0
add esp, 0xc
mov dword [ebp - 0x60], 0x44
lea eax, [ebp - 0x5c]
push 0x40
push 0
push eax
call fcn.0049b560
mov esi, dword [ebp - 4]
add esp, 0xc
mov eax, 1
mov dword [ebp - 0x34], 1
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40a21c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.00402f10
int3
Function at 0x40d460
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, 0x10
je 0x40d47b
cmp eax, 0xa3
je 0x40d486
mov dword [ebp + 8], eax
pop ebp
jmp sym.Setup.exe_public_virtual:_long_int___thiscall_DuiLib::WindowImplBase::HandleMessage_unsigned_int__unsigned_int__long_int_
push 0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop ebp
ret 0xc
Function at 0x40dd30
Capabilities:
Encode data using base64 via winapi
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x5023a4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x214]
mov esi, ecx
push 0
push eax
call fcn.0049b560
add esp, 0xc
lea eax, [ebp - 0x214]
push 0x104
push eax
push str._localappdata_GamePPGamePPConfig.ini
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call fcn.004031c0
mov ecx, eax
test ecx, ecx
je 0x40df5a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x218]
cmp byte [ebp + 8], 0
mov dword [ebp - 0x218], eax
push 2
je 0x40ddf1
push 0x4dc1e8
call fcn.00403760
mov ecx, esi
call fcn.0040e730
mov ecx, esi
call fcn.0040df70
mov eax, dword [0x506568]
test eax, eax
jne 0x40dde5
push 0x20d0
call fcn.0049786c
add esp, 4
mov ecx, eax
call fcn.00414c70
mov ecx, eax
mov dword [0x506568], eax
mov edx, dword [eax]
call dword [edx]
mov eax, dword [0x506568]
mov dword [eax + 0x1ec4], 1
jmp 0x40de40
push 0x4dc1f0
call fcn.00403760
mov ecx, esi
call fcn.0040e7f0
mov ecx, esi
call fcn.0040e350
mov eax, dword [0x506568]
test eax, eax
jne 0x40de36
push 0x20d0
call fcn.0049786c
add esp, 4
mov ecx, eax
call fcn.00414c70
mov ecx, eax
mov dword [0x506568], eax
mov edx, dword [eax]
call dword [edx]
mov eax, dword [0x506568]
mov dword [eax + 0x1ec4], 0
mov edi, dword [ebp - 0x218]
mov eax, dword [edi - 0xc]
lea ebx, [eax + eax]
mov dword [ebp - 0x224], ebx
call fcn.004031c0
mov ecx, eax
test ecx, ecx
je 0x40df64
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [ebp - 0x218], 0
lea esi, [eax + 0x10]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], esi
push eax
push 0
push 1
push ebx
mov ebx, dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
push edi
call ebx
mov eax, dword [ebp - 0x218]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004978aa
add esp, 4
mov dword [ebp - 0x220], eax
lea ecx, [ebp - 0x218]
push ecx
push eax
push 1
push dword [ebp - 0x224]
push edi
call ebx
mov ebx, dword [ebp - 0x220]
test eax, eax
je 0x40def7
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ded5
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x21c]
call fcn.00403760
mov esi, dword [ebp - 0x21c]
push ebx
call fcn.0049766a
add esp, 4
lea eax, [ebp - 0x214]
push eax
push esi
push str.CurrentType
push str.LANGUAGE
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea edx, [esi - 0x10]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40df32
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], esi
dec esi
test esi, esi
jg 0x40df47
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049765c
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00402f10
push 0x80004005
call fcn.00402f10
int3
Function at 0x40f5a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
call fcn.00408bd0
mov esi, eax
mov ecx, esi
call fcn.004071c0
test eax, eax
je 0x40f6dc
call fcn.004031c0
test eax, eax
je 0x40f6e2
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0xc], eax
call fcn.004031c0
test eax, eax
je 0x40f6e2
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 8], eax
call fcn.004031c0
mov ecx, eax
test ecx, ecx
je 0x40f6e2
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
lea ecx, [ebp - 4]
push str._uninstallpath
mov dword [ebp - 4], eax
call fcn.004034f0
test al, al
jne 0x40f642
mov ecx, str._uninstallpath
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f625
sub ecx, edx
sar ecx, 1
push ecx
push str._uninstallpath
lea ecx, [ebp - 4]
call fcn.00403760
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00406900
push eax
lea ecx, [ebp - 8]
call fcn.00403e50
mov edx, dword [ebp - 0x10]
or edi, 0xffffffff
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40f677
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 4]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40f691
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 8]
lea eax, [ebp - 0xc]
push esi
push str._sUninstall.exe
push eax
call fcn.004040c0
add esp, 0xc
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40f6bd
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0xc]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x40f6dc
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00402f10
int3
Function at 0x4105b0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x5023a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x506568]
push esi
push edi
test ebx, ebx
jne 0x4105f5
push 0x20d0
call fcn.0049786c
add esp, 4
mov ecx, eax
call fcn.00414c70
mov ecx, eax
mov dword [0x506568], eax
mov edx, dword [eax]
call dword [edx]
mov ebx, dword [0x506568]
lea ecx, [ebx + 0x414]
lea esi, [ebx + 0xc34]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ecx + 0x81e], ax
test ax, ax
jne 0x410601
push 0x4da000
push 0x104
push esi
call fcn.004a468c
add esp, 0xc
push str.GamePP.exe
push 0x104
push esi
call fcn.004a468c
add esp, 0xc
call fcn.00408bd0
mov ecx, eax
mov dword [ebp - 0x21c], eax
call fcn.00406dc0
test eax, eax
je 0x410787
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.0049b560
add esp, 0xc
mov dword [ebp - 0x218], 0
lea eax, [ebp - 0x218]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x4106a7
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [ebp - 0x218]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea edi, [ebp - 0x210]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x4106b0
mov eax, dword [0x4da000]
mov dword [edi], eax
lea eax, [ebp - 0x210]
push 0
push eax
push dword [ebx + 0x1ec4]
lea eax, [ebp - 0x214]
push eax
call fcn.00413040
mov eax, dword [ebp - 0x214]
cmp dword [eax - 4], 1
jle 0x4106fe
push dword [eax - 0xc]
lea ecx, [ebp - 0x214]
call fcn.00403890
mov eax, dword [ebp - 0x214]
mov edx, eax
mov esi, eax
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x410702
lea edi, [ebp - 0x210]
sub edx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x410720
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x214]
push dword [esi - 8]
push esi
call fcn.004a38d8
add esp, 8
test eax, eax
js 0x4107c5
cmp eax, dword [esi - 8]
jg 0x4107c5
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esi, 0xfffffff0
test eax, eax
je 0x41079f
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x410787
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, ebx
call fcn.00412c50
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049765c
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4107b4
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x21c]
call fcn.004071c0
test eax, eax
je 0x41078e
jmp 0x410787
push 0x80070057
call fcn.00402f10
int3
Function at 0x411760
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x5023a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
push edi
push 0x4dd270
push eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov byte [esi + 0x88], 0
movaps xmm0, xmmword [0x4de730]
movups xmmword [esi + 0x68], xmm0
movups xmmword [esi + 0x78], xmm0
call fcn.004a4080
mov edi, eax
add esp, 8
test edi, edi
je 0x41182a
push edi
push 0x400
lea eax, [ebp - 0x404]
push 1
push eax
call fcn.004aa23f
add esp, 0x10
test eax, eax
je 0x41181a
nop dword [eax]
push eax
lea eax, [ebp - 0x404]
mov ecx, esi
push eax
call fcn.004115a0
push edi
push 0x400
lea eax, [ebp - 0x404]
push 1
push eax
call fcn.004aa23f
add esp, 0x10
test eax, eax
jne 0x4117f0
mov ecx, esi
call fcn.00411650
push edi
call fcn.004a41bc
add esp, 4
mov ecx, dword [ebp - 4]
lea eax, [esi + 0x68]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049765c
mov esp, ebp
pop ebp
ret 4

Function at 0x411840
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, edx
mov dword [ebp - 0x10], eax
push ebx
mov ebx, ecx
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
jne 0x411898
call fcn.004031c0
mov ecx, eax
test ecx, ecx
je 0x411952
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov ecx, ebx
push 0x4d9ea8
mov dword [ebx], eax
call fcn.004034f0
test al, al
jne 0x41194b
push 0
push 0x4d9ea8
mov ecx, ebx
call fcn.00403760
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
push esi
lea ecx, [ebp - 8]
mov dword [ebp - 4], 0x400
push ecx
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 8], 0
push ecx
push 0
push 1
push dword [eax - 0xc]
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004978aa
mov ecx, dword [ebp - 4]
mov esi, eax
add ecx, ecx
push ecx
push 0
push esi
call fcn.0049b560
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 8]
add esp, 0x10
mov ecx, dword [ecx]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 1
push dword [ecx - 0xc]
push ecx
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
push esi
lea ecx, [ebp - 0x10]
call fcn.00403470
push esi
call fcn.0049766a
add esp, 4
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
call fcn.00403f10
mov edx, dword [ebp - 0x10]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
pop esi
test eax, eax
jg 0x41194b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00402f10
int3
Function at 0x411c60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0x4dc0e0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x411d06
mov edx, dword [ebp + 0x10]
mov eax, edx
push esi
push edi
lea esi, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x411c90
sub eax, esi
sar eax, 1
jne 0x411cbf
movq xmm0, qword [0x4da3b0]
movq qword [edx], xmm0
mov eax, dword [0x4da3b8]
mov dword [edx + 8], eax
mov ax, word [0x4da3bc]
mov word [edx + 0xc], ax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x104
push edx
push 1
push 0
push str.ChannelID
push dword [ebp - 4]
call esi
push 0x104
push dword [ebp + 0xc]
mov edi, eax
push 1
push 0
push str.SetupPath
push dword [ebp - 4]
call esi
push dword [ebp - 4]
test edi, edi
mov eax, 1
cmove ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x411d10
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa28
mov eax, dword [0x5023a4]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x20]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xa1c], eax
mov eax, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xa24], eax
mov eax, dword [ebp + 0x28]
push 0
mov dword [ebp - 0xa28], eax
call dword [sym.imp.ole32.dll_CoInitialize]
cmp dword [ebp - 0xa1c], 0
je 0x411da1
lea eax, [ebp - 0xa18]
push eax
push 0x4cef04
push 1
push 0
push 0x4cef24
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x411da1
mov eax, dword [ebp - 0xa18]
lea edx, [ebp - 0xa20]
push edx
push 0x4cef54
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
jns 0x411db6
mov eax, dword [ebp - 0xa18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0049765c
mov esp, ebp
pop ebp
ret 0x24
test esi, esi
je 0x411e12
mov eax, dword [ebp - 0xa18]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
push 0x800
lea eax, [ebp - 0xa14]
push 0
push eax
call fcn.0049b560
add esp, 0xc
lea eax, [ebp - 0xa14]
push 0x400
push esi
push eax
call fcn.004aa018
add esp, 0xc
lea eax, [ebp - 0xa14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [ebp - 0xa18]
lea edx, [ebp - 0xa14]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp - 0xa18]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
test ebx, ebx
je 0x411e31
mov eax, dword [ebp - 0xa18]
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test edi, edi
je 0x411e44
mov eax, dword [ebp - 0xa18]
push 0
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
push dword [ebp - 0xa1c]
lea eax, [ebp - 0x214]
push dword [ebp - 0xa24]
push 0x4dc0d4
push eax
call fcn.00410d80
mov eax, dword [ebp - 0xa18]
add esp, 0x10
push dword [ebp - 0xa28]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0xa20]
lea edx, [ebp - 0x214]
push 1
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ecx, dword [ebp - 0xa20]
mov edi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, dword [ebp - 0xa18]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov esi, dword [sym.imp.SHELL32.dll_SHChangeNotify]
lea eax, [ebp - 0x214]
push 0
push eax
push 5
push 2
call esi
push 0
push 0
push 0
push 0x8000000
call esi
mov ecx, dword [ebp - 8]
xor eax, eax
test edi, edi
pop edi
setns al
xor ecx, ebp
pop esi
pop ebx
call fcn.0049765c
mov esp, ebp
pop ebp
ret 0x24
Function at 0x411f80
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1678
call fcn.004981d0
mov eax, dword [0x5023a4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x80c]
push esi
push edi
push 0x800
mov esi, ecx
mov dword [ebp - 0x1678], ebx
push 0
push eax
mov dword [ebp - 0x1674], esi
call fcn.0049b560
add esp, 0xc
lea eax, [ebp - 0x100c]
push 0x800
push 0
push eax
call fcn.0049b560
lea edx, [ebp - 0x80c]
add esp, 0xc
mov ecx, ebx
sub edx, ebx
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x411fe1
lea ecx, [ebp - 0x80c]
add ecx, 0xfffffffe
nop word [eax + eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x412000
mov eax, dword [str..]
mov dword [ecx], eax
mov eax, dword [0x4dd600]
mov dword [ecx + 4], eax
mov ax, word [0x4dd604]
mov word [ecx + 8], ax
lea eax, [ebp - 0x125c]
push eax
lea eax, [ebp - 0x80c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x1670], eax
cmp eax, 0xffffffff
je 0x4121b5
mov ebx, dword [ebp + 0x10]
mov edi, eax
nop dword [eax]
mov ecx, 0x4dd608
lea eax, [ebp - 0x1230]
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x412086
test dx, dx
je 0x412082
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x412086
add eax, 4
add ecx, 4
test dx, dx
jne 0x412060
xor eax, eax
jmp 0x41208b
sbb eax, eax
or eax, 1
test eax, eax
je 0x412198
mov ecx, 0x4dd274
lea eax, [ebp - 0x1230]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4120c6
test dx, dx
je 0x4120c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4120c6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4120a0
xor eax, eax
jmp 0x4120cb
sbb eax, eax
or eax, 1
test eax, eax
je 0x412198
lea eax, [ebp - 0x1230]
push eax
push dword [ebp - 0x1678]
lea eax, [ebp - 0x100c]
push 0x4dc0d4
push eax
call fcn.00410d80
add esp, 0x10
test byte [ebp - 0x125c], 0x10
je 0x412116
push ebx
push 0x4d9ea8
lea eax, [ebp - 0x100c]
mov ecx, esi
push eax
call fcn.00411f80
jmp 0x412198
xor ecx, ecx
nop dword [eax + eax]
movzx eax, word [ebp + ecx - 0x100c]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x166e], ax
test ax, ax
jne 0x412120
cmp ebx, 1
jne 0x412145
lea eax, [esi + 0x1e9c]
jmp 0x41215d
cmp ebx, 2
jne 0x412152
lea eax, [esi + 0x1ea8]
jmp 0x41215d
cmp ebx, 3
jne 0x412198
lea eax, [esi + 0x1eb4]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
je 0x412189
mov ecx, 0x104
lea esi, [ebp - 0x166c]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
add dword [eax + 4], 0x410
mov esi, dword [ebp - 0x1674]
mov edi, dword [ebp - 0x1670]
jmp 0x412198
lea ecx, [ebp - 0x166c]
push ecx
push edx
mov ecx, eax
call fcn.004167a0
lea eax, [ebp - 0x125c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x412050
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 8]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049765c
mov esp, ebp
pop ebp
ret 0xc