joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416731
Capabilities:
Check if file exists

Disassembly:
push 0xd0
mov eax, 0x4c377b
call fcn.00422d2f
mov esi, ecx
lea eax, [esi + 0x69c]
xor edi, edi
cmp dword [eax], edi
je 0x4168d7
mov ecx, dword [eax]
mov eax, dword [ecx]
lea edx, [ebp - 0xdc]
xor ebx, ebx
push edx
inc ebx
call dword [eax + 0x28]
mov ecx, eax
mov dword [ebp - 4], edi
call dword [0x4eb0cc]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00401c20
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 2
call dword [0x4eb06c]
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x416793
lea eax, [ebp - 0x28]
push eax
call fcn.0042237a
cmp eax, 3
pop ecx
jle 0x4167d6
push 3
push edi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00403ab0
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x4167ba
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4167c7
xor ebx, ebx
push edi
push 1
lea ecx, [ebp - 0x48]
call fcn.00401e20
cmp ebx, edi
jne 0x4167f6
lea eax, [esi + 0x66c]
cmp dword [eax], edi
je 0x4168cc
mov eax, dword [eax]
mov edx, dword [eax]
push edi
mov ecx, eax
call dword [edx + 0xd8]
jmp 0x4168cc
mov ecx, dword [esi + 0x674]
cmp ecx, edi
je 0x416858
call dword [0x4eb084]
test al, al
lea eax, [esi + 0x66c]
je 0x416830
cmp dword [eax], edi
je 0x416822
mov eax, dword [eax]
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx + 0xd8]
lea eax, [esi + 0x670]
cmp dword [eax], edi
je 0x416858
push 1
jmp 0x41684c
cmp dword [eax], edi
je 0x416841
mov eax, dword [eax]
mov edx, dword [eax]
push edi
mov ecx, eax
call dword [edx + 0xd8]
lea eax, [esi + 0x670]
cmp dword [eax], edi
je 0x416858
push edi
mov eax, dword [eax]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xd8]
lea ebx, [esi + 0x50c]
push ebx
push dword [ebx + 4]
lea ecx, [ebp - 0x50]
call fcn.004151e5
push ebx
push dword [ebx + 8]
lea ecx, [ebp - 0x58]
call fcn.004151e5
jmp 0x4168a8
lea ecx, [ebp - 0x50]
call fcn.0040c772
cmp dword [eax], edi
je 0x4168a0
lea ecx, [ebp - 0x50]
call fcn.0040c772
cmp dword [ebp - 0x14], 8
mov ecx, dword [eax]
mov eax, dword [ebp - 0x28]
jae 0x41689a
lea eax, [ebp - 0x28]
mov edx, dword [ecx]
push eax
call dword [edx + 0x10]
lea ecx, [ebp - 0x50]
call fcn.0040c0de
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x50]
call fcn.00411ded
test al, al
je 0x416878
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x4168c4
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
call fcn.00415b9a
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401e20
call fcn.00422db2
ret
Function at 0x417304
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [esp + 0x14]
call fcn.0042237a
mov edi, eax
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004211ce
push dword [esp + 0x1c]
mov esi, eax
push esi
call fcn.0042235e
add esp, 0x10
xor ebp, ebp
test edi, edi
mov bl, 1
jl 0x417373
cmp word [esi + ebp*2], 0x5c
jne 0x41736a
and word [esi + ebp*2], 0
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x417364
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x417371
mov word [esi + ebp*2], 0x5c
inc ebp
cmp ebp, edi
jle 0x417341
jmp 0x417373
xor bl, bl
push esi
call fcn.004231fd
pop ecx
pop edi
pop esi
pop ebp
movzx eax, bl
pop ebx
ret

Function at 0x417519
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x7a8]
sub esp, 0x828
mov eax, dword [0x50db70]
xor eax, ebp
mov dword [ebp + 0x7a4], eax
push esi
push edi
mov edi, dword [ebp + 0x7b0]
push 0x44
xor esi, esi
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.004221d0
push 0x10
lea eax, [ebp - 0x3c]
push esi
push eax
mov dword [ebp - 0x80], 0x44
call fcn.004221d0
push edi
lea eax, [ebp - 0x2c]
push 0x4c86fc
push eax
call fcn.00423151
add esp, 0x24
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
push 1
push esi
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x41759d
push dword [ebp - 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x38]
call esi
mov ecx, dword [ebp + 0x7a4]
pop edi
xor ecx, ebp
pop esi
call fcn.004221b5
add ebp, 0x7a8
leave
ret

Function at 0x4175b4
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x50db70]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
cmp edi, esi
je 0x41764e
push 0x228
lea eax, [ebp - 0x22c]
push esi
push eax
mov dword [ebp - 0x230], esi
call fcn.004221d0
add esp, 0xc
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x41764e
lea eax, [ebp - 0x230]
push eax
push esi
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x417643
push edi
call fcn.00424617
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00424617
pop ecx
push eax
call fcn.00423395
test eax, eax
pop ecx
pop ecx
je 0x41765e
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x417615
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004221b5
leave
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x228]
jmp 0x417650
Function at 0x417813
Capabilities:
Check if file exists
Copy file
Delete file
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x5a8]
sub esp, 0x628
mov eax, dword [0x50db70]
xor eax, ebp
mov dword [ebp + 0x5a4], eax
mov eax, dword [ebp + 0x5b4]
push ebx
push esi
mov esi, dword [ebp + 0x5b0]
push edi
mov ebx, 0x206
xor edi, edi
push ebx
mov dword [ebp - 0x78], eax
lea eax, [ebp + 0x196]
push edi
push eax
mov dword [ebp - 0x80], esi
mov word [ebp + 0x194], di
call fcn.004221d0
push ebx
lea eax, [ebp - 0x72]
push edi
push eax
mov word [ebp - 0x74], di
call fcn.004221d0
lea eax, [ebp + 0x194]
push esi
push eax
call fcn.0042235e
push dword [ebp - 0x78]
lea eax, [ebp - 0x74]
push eax
call fcn.0042235e
lea eax, [ebp + 0x194]
push eax
call fcn.004243f4
lea eax, [ebp - 0x74]
push eax
call fcn.004243f4
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x194]
push eax
call fcn.00423395
add esp, 0x38
test eax, eax
je 0x41797b
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [ebp - 0x7c], edi
push ebx
lea eax, [ebp + 0x39e]
push edi
push eax
mov word [ebp + 0x39c], di
call fcn.004221d0
add esp, 0xc
cmp dword [ebp - 0x7c], edi
lea eax, [ebp + 0x39c]
jne 0x4178f6
push dword [ebp - 0x78]
push str._s.bak
push eax
call fcn.00423151
add esp, 0xc
jmp 0x41790a
push dword [ebp - 0x7c]
push dword [ebp - 0x78]
push str._s.bak_d
push eax
call fcn.00423151
add esp, 0x10
lea eax, [ebp + 0x39c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x417928
lea eax, [ebp + 0x39c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp + 0x39c]
push eax
push dword [ebp - 0x78]
call fcn.00424680
pop ecx
pop ecx
lea eax, [ebp + 0x39c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
push dword [ebp - 0x78]
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 5
test eax, eax
push edi
lea eax, [ebp + 0x39c]
push eax
jne 0x417971
call esi
cmp dword [ebp - 0x7c], 0xa
jge 0x41797b
inc dword [ebp - 0x7c]
jmp 0x4178c0
call esi
push 5
push edi
push dword [ebp - 0x80]
call esi
mov ecx, dword [ebp + 0x5a4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004221b5
add ebp, 0x5a8
leave
ret
Function at 0x417993
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x50db70]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
push str..del
push edi
call fcn.004230b6
test eax, eax
pop ecx
pop ecx
je 0x4179cb
push 5
push 0
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x417a62
push esi
xor esi, esi
and word [ebp - 0x20c], 0
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
call fcn.004221d0
add esp, 0xc
test esi, esi
lea eax, [ebp - 0x20c]
jne 0x417a07
push edi
push str._s.del
push eax
call fcn.00423151
add esp, 0xc
jmp 0x417a17
push esi
push edi
push str._s.del_d
push eax
call fcn.00423151
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x417a41
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x417a41
cmp esi, 0xa
jge 0x417a61
inc esi
jmp 0x4179ce
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.00424680
pop ecx
pop ecx
push 5
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004221b5
leave
ret

Function at 0x417a6f
Capabilities:
Check if file exists
Delete file
Get common file path
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x5a4]
sub esp, 0x624
mov eax, dword [0x50db70]
xor eax, ebp
mov dword [ebp + 0x5a0], eax
push esi
mov esi, dword [ebp + 0x5ac]
push esi
mov dword [ebp - 0x80], esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x417bb3
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call ebx
test eax, eax
jne 0x417bb2
push edi
mov esi, 0x206
xor edi, edi
push esi
lea eax, [ebp - 0x76]
push edi
push eax
mov word [ebp - 0x78], di
call fcn.004221d0
push esi
lea eax, [ebp + 0x192]
push edi
push eax
mov word [ebp + 0x190], di
call fcn.004221d0
add esp, 0x18
lea eax, [ebp + 0x190]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x80]
call fcn.0041766d
pop ecx
pop ecx
mov dword [ebp - 0x7c], edi
push esi
lea eax, [ebp + 0x39a]
push edi
push eax
mov word [ebp + 0x398], di
call fcn.004221d0
add esp, 0xc
cmp dword [ebp - 0x7c], edi
lea eax, [ebp - 0x78]
jne 0x417b45
push eax
lea eax, [ebp + 0x190]
push eax
lea eax, [ebp + 0x398]
push str._s_s.del
push eax
call fcn.00423151
add esp, 0x10
jmp 0x417b64
push dword [ebp - 0x7c]
push eax
lea eax, [ebp + 0x190]
push eax
lea eax, [ebp + 0x398]
push str._s_s.del_d
push eax
call fcn.00423151
add esp, 0x14
lea eax, [ebp + 0x398]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x417b90
lea eax, [ebp + 0x398]
push eax
call ebx
cmp eax, edi
jne 0x417b90
cmp dword [ebp - 0x7c], 0xa
jge 0x417bb1
inc dword [ebp - 0x7c]
jmp 0x417b07
lea eax, [ebp + 0x398]
push eax
push dword [ebp - 0x80]
call fcn.00424680
pop ecx
pop ecx
push 5
push edi
lea eax, [ebp + 0x398]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop edi
pop ebx
mov ecx, dword [ebp + 0x5a0]
xor ecx, ebp
pop esi
call fcn.004221b5
add ebp, 0x5a4
leave
ret
Function at 0x417c95
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0042237a
test eax, eax
pop ecx
je 0x417ced
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.004221d0
add esp, 0xc
xor ecx, ecx
inc ecx
push ecx
push 0
push 0
mov eax, str.open
push esi
push eax
push 0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], 0x200
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x417ced
push esi
call fcn.00417519
pop ecx
pop esi
leave
ret

Function at 0x417cf0
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x50db70]
xor eax, ebp
mov dword [ebp + 0x9c], eax
push 0x11c
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.004221d0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
movzx eax, byte [ebp + 0x9a]
push eax
push dword [ebp - 0x78]
push dword [ebp - 0x7c]
push str._d__d__d
call fcn.00417bc9
mov ecx, dword [ebp + 0x9c]
add esp, 0x10
cmp dword [ebp - 0x7c], 6
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.004221b5
add ebp, 0xa0
leave
ret

Function at 0x418b68
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x14]
push eax
push 0
push esi
push 0x418a99
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x18], eax
pop esi
je 0x418b97
cmp eax, 0xffffffff
je 0x418b97
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
ret

Function at 0x41efc5
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x50db70]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
push 0x206
lea eax, [ebp - 0x20a]
push edi
push eax
mov esi, ecx
mov word [ebp - 0x20c], di
call fcn.004221d0
add esp, 0xc
push edi
push 0x26
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
lea edi, [esi + 0x3c]
push eax
mov ecx, edi
call fcn.00401df0
mov esi, 0x4eaef0
push esi
mov ecx, edi
call fcn.00403af0
push str.Hao123Picture
mov ecx, edi
call fcn.00403af0
push esi
mov ecx, edi
call fcn.00403af0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004221b5
leave
ret
Function at 0x41f04b
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
sub esp, 0x448
lea ebp, [esp - 4]
mov eax, dword [0x50db70]
xor eax, ebp
mov dword [ebp + 0x448], eax
push 0x44
mov eax, 0x4c42e7
call fcn.00422cc6
mov eax, dword [ebp + 0x454]
mov edi, ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], eax
call fcn.00401a00
xor ebx, ebx
mov esi, 0x206
push esi
lea eax, [ebp + 0x242]
push ebx
push eax
mov dword [ebp - 4], ebx
mov word [ebp + 0x240], bx
call fcn.004221d0
push esi
lea eax, [ebp + 0x3a]
push ebx
push eax
mov word [ebp + 0x38], bx
call fcn.004221d0
add esp, 0x18
lea eax, [ebp + 0x240]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x41f1ac
lea eax, [ebp + 0x38]
push eax
push dword [ebp - 0x10]
call fcn.004176f3
pop ecx
pop ecx
lea eax, [ebp + 0x240]
push eax
lea ecx, [ebp - 0x34]
call fcn.00401c20
push dword [ebp - 0x10]
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 1
call fcn.00401c20
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.00401aa0
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x50]
call fcn.00401e20
push ebx
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.00401e20
lea eax, [ebp + 0x240]
push eax
lea ecx, [ebp + 0x1c]
call fcn.00401c20
lea eax, [ebp + 0x38]
push eax
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 3
call fcn.00403af0
mov ecx, edi
call fcn.0041efc5
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp]
push eax
call fcn.00417eda
pop ecx
pop ecx
cmp dword [ebp + 0x18], 0x10
mov eax, dword [ebp + 4]
mov byte [ebp - 4], 4
jae 0x41f16c
lea eax, [ebp + 4]
cmp dword [edi + 0x54], 8
jb 0x41f177
mov edi, dword [edi + 0x40]
jmp 0x41f17a
add edi, 0x40
push ebx
push eax
push edi
call fcn.004098a2
mov eax, dword [ebp + 0x20]
add esp, 0xc
cmp dword [ebp + 0x34], 8
jae 0x41f191
lea eax, [ebp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push esi
lea ecx, [ebp]
call fcn.00401da0
push ebx
push esi
lea ecx, [ebp + 0x1c]
call fcn.00401e20
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00401a90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x448]
xor ecx, ebp
call fcn.004221b5
add ebp, 0x44c
leave
ret 4
Function at 0x41f2ec
Capabilities:
Create process on windows

Disassembly:
push 0x20
mov eax, 0x4c2bb3
call fcn.00422d2f
mov eax, dword [ebp + 0xc]
mov esi, ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.00401c20
xor edi, edi
push 0x4cab2c
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], edi
call fcn.00403af0
cmp dword [esi + 0x18], 8
jb 0x41f323
mov edx, dword [esi + 4]
jmp 0x41f326
lea edx, [esi + 4]
cmp dword [esi + 0x34], 8
jb 0x41f331
mov eax, dword [esi + 0x20]
jmp 0x41f334
lea eax, [esi + 0x20]
cmp dword [ebp - 0x14], 8
mov ecx, dword [ebp - 0x28]
jae 0x41f340
lea ecx, [ebp - 0x28]
push edi
push edi
push edi
push 1
push edx
push edi
push eax
push ecx
mov ecx, esi
call fcn.0041f1dd
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x41f35c
lea eax, [ebp - 0x28]
push edi
push edi
push edi
push eax
push str.startpin
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401e20
call fcn.00422db2
ret 8

Function at 0x41f37f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x50db70]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push edi
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
mov edi, ecx
call fcn.004221d0
add esp, 0xc
push 0
push 0x19
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41f3dd
lea eax, [ebp - 0x20c]
push eax
push str.ItemDestop
mov ecx, edi
call fcn.0041f2ec
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004221b5
leave
ret

Function at 0x41f3ea
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x50db70]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push edi
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
mov edi, ecx
call fcn.004221d0
add esp, 0xc
push 0
push 0xb
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41f448
lea eax, [ebp - 0x20c]
push eax
push str.ItemTopStartMenu
mov ecx, edi
call fcn.0041f2ec
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004221b5
leave
ret

Function at 0x41f455
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x50db70]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push edi
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
mov edi, ecx
call fcn.004221d0
add esp, 0xc
push 0
push 2
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
push eax
push str.ItemSecondStartMenu
mov ecx, edi
call fcn.0041f2ec
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004221b5
leave
ret
Function at 0x41f4bc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x50db70]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push edi
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
mov edi, ecx
call fcn.004221d0
add esp, 0xc
push 0
push 0x1a
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41f52d
lea eax, [ebp - 0x20c]
push str.MicrosoftInternet_ExplorerQuick_Launch
push eax
call fcn.00422334
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
push str.ItemQuickLauch
mov ecx, edi
call fcn.0041f2ec
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004221b5
leave
ret
Function at 0x41fb0f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x50db70]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
push 0x206
lea eax, [ebp - 0x20a]
push edi
push eax
mov esi, ecx
mov word [ebp - 0x20c], di
call fcn.004221d0
add esp, 0xc
call fcn.00417cf0
test eax, eax
push edi
lea eax, [ebp - 0x20c]
je 0x41fb58
push 0x1a
jmp 0x41fb5a
push 0x26
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
lea edi, [esi + 0x3c]
push eax
mov ecx, edi
call fcn.00401df0
mov esi, 0x4eaef0
push esi
mov ecx, edi
call fcn.00403af0
push str.hao123JuziBrowser
mov ecx, edi
call fcn.00403af0
push esi
mov ecx, edi
call fcn.00403af0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004221b5
leave
ret
Function at 0x420330
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x50db70]
xor eax, ebp
mov dword [ebp + 0x190], eax
push esi
xor esi, esi
push 0x206
lea eax, [ebp - 0x76]
push esi
push eax
mov word [ebp - 0x78], si
call fcn.004221d0
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
push esi
push esi
push 0x25
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x4203e7
push 0x4c7cf0
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x4203e7
push ebx
push esi
lea eax, [ebp - 0x78]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
cmp ebx, esi
jbe 0x4203e6
push edi
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
cmp edi, esi
je 0x4203e5
push edi
push ebx
push esi
lea eax, [ebp - 0x78]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4203de
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x4eaef0
push edi
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x7c], esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4203de
mov eax, dword [ebp - 0x7c]
mov esi, dword [eax + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop ebx
mov ecx, dword [ebp + 0x190]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004221b5
add ebp, 0x194
leave
ret

Function at 0x4203ff
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
lea ebp, [esp - 0x240]
sub esp, 0x2c0
mov eax, dword [0x50db70]
xor eax, ebp
mov dword [ebp + 0x23c], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push dword [ebp + 0x248]
mov byte [ebp - 0x79], bl
push ebx
mov dword [ebp - 0x80], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
jne 0x42048a
push esi
push 0x2b0
lea eax, [ebp - 0x74]
push ebx
push eax
mov dword [ebp - 0x78], ebx
call fcn.004221d0
add esp, 0xc
mov esi, 0x208
push esi
push 0x2b4
lea eax, [ebp - 0x78]
push eax
push ebx
push dword [ebp - 0x80]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
setne byte [ebp - 0x79]
cmp byte [ebp - 0x79], bl
je 0x420480
push esi
lea eax, [ebp - 0x6c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push dword [ebp - 0x80]
call dword [sym.imp.SHELL32.dll_ILFree]
pop esi
mov ecx, dword [ebp + 0x23c]
mov al, byte [ebp - 0x79]
xor ecx, ebp
pop ebx
call fcn.004221b5
add ebp, 0x240
leave
ret 4