joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4419ae
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x38
push ebx
push ebp
push esi
mov si, word [esp + 0x50]
xor ebx, ebx
push edi
push 2
pop ebp
push 0x17
pop ecx
cmp si, cx
jne 0x441a1f
xor eax, eax
lea edi, [esp + 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x50]
push ecx
call dword [sym.imp.WS2_32.dll_InetPtonW]
cmp eax, 1
jne 0x441a55
mov eax, dword [esp + 0x50]
lea esi, [esp + 0x18]
push 0x17
pop ecx
lea edx, [esp + 0x18]
lea edi, [eax + 8]
mov word [eax], cx
movsd dword es:[edi], dword [esi]
mov ecx, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x48d470
mov eax, dword [edx + ecx*4]
cmp eax, dword [esi + ecx*4]
jne 0x441a16
inc ecx
cmp ecx, 4
jne 0x441a06
jmp 0x441a18
mov bl, 1
mov al, bl
jmp 0x441b0f
cmp si, bp
jne 0x441a55
lea eax, [esp + 0x54]
mov dword [esp + 0x54], ebx
push eax
push dword [esp + 0x50]
push ebp
call dword [sym.imp.WS2_32.dll_InetPtonW]
cmp eax, 1
jne 0x441a55
mov ecx, dword [esp + 0x50]
mov eax, dword [esp + 0x54]
test eax, eax
mov dword [ecx + 4], eax
setne al
mov word [ecx], bp
jmp 0x441b0f
lea eax, [esp + 0x14]
mov dword [esp + 0x28], ebx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x18], ebx
push eax
push ebx
push dword [esp + 0x58]
xorps xmm0, xmm0
mov dword [esp + 0x3c], ebx
movlpd qword [esp + 0x48], xmm0
movlpd qword [esp + 0x50], xmm0
mov dword [esp + 0x40], 1
mov dword [esp + 0x44], 6
call dword [sym.imp.WS2_32.dll_GetAddrInfoW]
test eax, eax
jne 0x441b0d
mov edx, dword [esp + 0x14]
test edx, edx
je 0x441b0d
mov eax, edx
movzx ecx, si
cmp dword [eax + 4], ecx
je 0x441ab4
mov eax, dword [eax + 0x1c]
test eax, eax
jne 0x441aa6
jmp 0x441b01
mov edi, dword [eax + 0x18]
push 0x17
pop ecx
cmp si, cx
jne 0x441aee
mov eax, dword [esp + 0x50]
lea esi, [edi + 8]
lea ebp, [eax + 8]
mov edi, ebp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov word [eax], cx
mov esi, 0x48d470
mov ecx, ebx
mov eax, dword [ebp + ecx*4]
cmp eax, dword [esi + ecx*4]
jne 0x441aea
inc ecx
cmp ecx, 4
jne 0x441ad9
jmp 0x441b01
mov bl, 1
jmp 0x441b01
mov ecx, dword [esp + 0x50]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
mov word [ecx], bp
cmp dword [edi + 4], ebx
setne bl
push edx
call dword [sym.imp.WS2_32.dll_FreeAddrInfoW]
jmp 0x441a18
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 0xc
Function at 0x44291a
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
lea eax, [ebp - 0x288]
push esi
push 0x288
xor esi, esi
push esi
push eax
call fcn.0041c3f0
add esp, 0xc
push dword [esi + 0x46ab10]
lea ecx, [ebp - 0x288]
push 0x3f
pop edx
call fcn.00403b43
push dword [esi + 0x46ab14]
lea ecx, [ebp - 0x208]
push 0x7f
pop edx
call fcn.00403b43
push dword [esi + 0x46ab18]
lea ecx, [ebp - 0x108]
push 0x7f
pop edx
call fcn.00403b43
push 1
lea eax, [ebp - 0x288]
mov ecx, 0x4b37ac
push eax
call fcn.00402e44
add esi, 0xc
cmp esi, 0xcc
jb 0x44293b
pop esi
leave
ret

Function at 0x442998
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
push ecx
call dword [sym.imp.KERNEL32.DLL_GetUserDefaultUILanguage]
movzx ecx, ax
lea edx, [ebp - 0x100]
call fcn.004437b1
mov edx, 0x469eec
pop ecx
test al, al
je 0x4429d8
lea esi, [ebp - 0x100]
xor ecx, ecx
movzx eax, byte [esi + ecx]
cmp al, byte [edx + ecx]
jne 0x4429eb
inc ecx
cmp ecx, 3
jne 0x4429c9
push ecx
push edx
push ecx
push 0x3f
pop edx
mov ecx, 0x4b3c00
call fcn.0043eb0e
pop esi
leave
ret
lea eax, [ebp - 0x100]
push eax
push str._s_en
push 0x3f
push 0x4b3c00
call fcn.00406ca3
add esp, 0x10
jmp 0x4429e8
Function at 0x442acf
Capabilities:
Get common file path
Initialize winsock library

Disassembly:
sub esp, 0x210
push ebx
push ebp
push esi
push edi
mov edi, 0x4b3270
push edi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
xor esi, esi
mov dword [0x4b3790], eax
cmp byte [0x4b3cec], 0
jne 0x442b37
push 0x190
lea eax, [esp + 0x1c]
push esi
push eax
call fcn.0041c3f0
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x442b30
push edi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
xor al, al
jmp 0x442ca6
mov byte [0x4b3cec], 1
mov ebx, 0x4b3380
push ebx
push esi
push esi
push 0x1a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, 0x103
mov ebp, 0x4b3588
push ebx
mov edx, esi
mov ecx, ebp
call fcn.00403b43
push ebx
mov edx, esi
lea ecx, [esp + 0x1c]
call fcn.00403b43
lea eax, [esp + 0x14]
mov edx, esi
push eax
lea ecx, [esp + 0x1c]
call fcn.0043b6e1
test eax, eax
js 0x442b97
mov eax, dword [esp + 0x14]
mov edx, esi
push ecx
push 0x46abe0
push ecx
lea ecx, [esp + 0x24]
sub edx, eax
lea ecx, [ecx + eax*2]
call fcn.0043b61f
lea ecx, [esp + 0x18]
call fcn.00408bb0
lea eax, [esp + 0x14]
mov edx, esi
push eax
lea ecx, [esp + 0x1c]
call fcn.0043b6e1
test eax, eax
js 0x442bcf
mov eax, dword [esp + 0x14]
mov edx, esi
push ecx
push str.Terminal
push ecx
lea ecx, [esp + 0x24]
sub edx, eax
lea ecx, [ecx + eax*2]
call fcn.0043b61f
lea ecx, [esp + 0x18]
call fcn.00408bb0
lea eax, [esp + 0x14]
mov edx, esi
push eax
lea ecx, [esp + 0x1c]
call fcn.0043b6e1
test eax, eax
js 0x442c07
mov eax, dword [esp + 0x14]
mov edx, esi
push ecx
push str.Community
push ecx
lea ecx, [esp + 0x24]
sub edx, eax
lea ecx, [ecx + eax*2]
call fcn.0043b61f
lea ecx, [esp + 0x18]
call fcn.00408bb0
push str.MetaQuotesTerminalCommunitydns.dat
mov edx, esi
mov ecx, ebx
call fcn.004038fe
push str.MetaQuotesTerminalCommunitycookies.dat
mov edx, esi
mov ecx, ebp
call fcn.004038fe
call fcn.00442998
call fcn.0044291a
call fcn.004424b4
call fcn.004423b2
push edi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
push str..mql5.com
call fcn.0044204b
push str..mql5.net
call fcn.0044204b
push str..finteza.com
call fcn.0044204b
push str..metaquotes.net
call fcn.0044204b
push str..metatrader.com
call fcn.0044204b
call fcn.004428a7
test al, al
je 0x442ca4
mov esi, 0x4b3ce0
mov ecx, esi
call fcn.004038c1
test al, al
jne 0x442ca4
push 0x400000
push edi
push 0x44118c
mov ecx, esi
call fcn.00403860
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret 0xc
Function at 0x445415
Capabilities:
Create process on windows
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
lea eax, [ebp - 0x244]
push ebx
push edi
mov ebx, 0x208
xor edi, edi
push ebx
push edi
push eax
call fcn.0041c3f0
add esp, 0xc
lea eax, [ebp - 0x244]
push eax
push edi
push edi
push 0x26
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [ebp - 0x244]
call fcn.0041001b
test al, al
jne 0x4454cc
call fcn.0040a3a4
test al, al
je 0x4454cc
call fcn.0040a347
test al, al
jne 0x4454cc
push 0x3c
lea eax, [ebp - 0x3c]
push edi
push eax
call fcn.0041c3f0
push ebx
lea eax, [ebp - 0x44c]
push edi
push eax
call fcn.0041c3f0
add esp, 0x18
mov dword [ebp - 0x3c], 0x3c
lea eax, [ebp - 0x44c]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0x46293c
push 0x103
push eax
push edi
mov dword [ebp - 0x30], 0x46bd40
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4454cc
xor al, al
jmp 0x4454ce
mov al, 1
pop edi
pop ebx
leave
ret
Function at 0x446ec3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, ecx
call fcn.00446e89
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov dword [esi + 0x118], eax
cmp eax, 0x390
jb 0x446f22
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov dword [esi + 0x110], eax
test eax, eax
je 0x446f22
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [esi + 0x114], eax
test eax, eax
jne 0x446f2f
push dword [esi + 0x110]
call dword [sym.imp.KERNEL32.DLL_FreeResource]
and dword [esi + 0x110], 0
and dword [esi + 0x118], 0
xor al, al
pop esi
ret 8
mov al, 1
jmp 0x446f2b

Function at 0x447fe7
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Import public key
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 0
push esi
push edi
mov esi, ecx
je 0x448056
cmp dword [ebp + 0xc], 0
je 0x448056
cmp dword [ebp + 0x10], 0
je 0x448056
cmp dword [ebp + 0x14], 0
je 0x448056
mov eax, dword [esi]
test eax, eax
je 0x448056
xor edi, edi
cmp dword [eax + 0xc], edi
je 0x448056
push 0xf0000000
push 1
push edi
push edi
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x448056
lea eax, [ebp - 8]
push eax
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
add eax, 0x38
push eax
push 0x10001
push dword [ebp - 4]
call dword [sym.imp.CRYPT32.dll_CryptImportPublicKeyInfo]
test eax, eax
jne 0x44805e
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
pop edi
pop esi
leave
ret 0x10
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push 0x8004
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x448081
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x44804c
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x4480a9
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x44804c
push edi
push edi
push dword [ebp - 8]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptVerifySignatureW]
push dword [ebp - 8]
test eax, eax
je 0x448098
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, 1
jmp 0x448058
Function at 0x448c10
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x408
cmp dword [eax + 4], 0
push ebx
push ebp
push esi
push edi
mov ebx, ecx
je 0x448c9a
xor ebp, ebp
push ebp
push 0x80
push 3
push ebp
push 3
push SysReAllocStringLen
push dword [eax + 4]
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x448c9a
mov esi, ebp
push ebp
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ebp
push eax
mov eax, 0x400
sub eax, esi
push eax
lea eax, [esp + 0x24]
add eax, esi
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x448c80
cmp dword [esp + 0x14], ebp
je 0x448c80
add esi, dword [esp + 0x14]
cmp esi, 0x400
jb 0x448c4a
test esi, esi
je 0x448c93
push esi
lea eax, [esp + 0x1c]
mov ecx, ebx
push eax
call fcn.00448f08
jmp 0x448c48
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x408
ret 4

Function at 0x448ca7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, ecx
push ebx
push esi
test edx, edx
je 0x448cf8
cmp dword [ebp + 0xc], 0
xorps xmm0, xmm0
movlpd qword [ebp - 8], xmm0
jb 0x448cf8
ja 0x448cca
cmp dword [ebp + 8], 0
jbe 0x448cf8
mov esi, dword [ebp - 4]
xor bl, bl
mov ecx, dword [ebp - 8]
mov eax, ecx
and eax, 0xf
mov al, byte [eax*4 + 0x464820]
add al, bl
xor byte [ecx + edx], al
mov bl, byte [ecx + edx]
add ecx, 1
adc esi, 0
cmp esi, dword [ebp + 0xc]
jb 0x448cd2
ja 0x448cf8
cmp ecx, dword [ebp + 8]
jb 0x448cd2
pop esi
pop ebx
leave
ret

Function at 0x448d4c
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x448d82
test esi, esi
je 0x448d8d
xor edx, edx
test edi, edi
je 0x448d8d
mov ch, dl
mov cl, byte [edx + esi]
mov eax, edx
and eax, 0xf
mov al, byte [eax + ebx]
add al, ch
mov ch, cl
xor al, cl
mov byte [edx + esi], al
inc edx
cmp edx, edi
jb 0x448d67
jmp 0x448d8d
push 0x464820
call fcn.00448e86
pop ecx
pop edi
pop esi
pop ebx
ret

Function at 0x448d91
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x448dd2
cmp dword [ebp + 0xc], 0
je 0x448dd2
test esi, esi
je 0x448ddd
xor ecx, ecx
test edi, edi
je 0x448ddd
mov byte [ebp + 0xb], cl
xor edx, edx
mov eax, ecx
div dword [ebp + 0xc]
mov al, byte [edx + ebx]
add al, byte [ebp + 0xb]
xor byte [ecx + esi], al
mov al, byte [ecx + esi]
inc ecx
mov byte [ebp + 0xb], al
cmp ecx, edi
jb 0x448db5
jmp 0x448ddd
push 0x464820
call fcn.00448e58
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x448e31
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov byte [ecx + 0x68], al
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x448e58
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x448e84
xor ecx, ecx
test edx, edx
je 0x448e84
push ebx
push edi
mov edi, dword [esp + 0x10]
mov bl, cl
mov eax, ecx
and eax, 0xf
mov al, byte [edi + eax*4]
add al, bl
xor byte [ecx + esi], al
mov bl, byte [ecx + esi]
inc ecx
cmp ecx, edx
jb 0x448e6d
pop edi
pop ebx
pop esi
ret

Function at 0x448e86
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x448eba
xor edx, edx
test edi, edi
je 0x448eba
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov bl, dl
mov cl, byte [edx + esi]
mov eax, edx
and eax, 0xf
mov al, byte [ebp + eax*4]
add al, bl
mov bl, cl
xor al, cl
mov byte [edx + esi], al
inc edx
cmp edx, edi
jb 0x448e9e
pop ebp
pop ebx
pop edi
pop esi
ret
Function at 0x44915a
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x464
push ebx
push esi
push edi
xor eax, eax
push 0x208
push eax
mov dword [ebp - 4], eax
mov edi, eax
lea eax, [ebp - 0x210]
push eax
call fcn.0041c3f0
mov esi, dword [ebp + 8]
add esp, 0xc
test esi, esi
je 0x449348
push 0x46ed74
push esi
push str._s_s
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.0040397c
add esp, 0x14
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4492f7
test byte [ebp - 0x460], 0x10
lea eax, [ebp - 0x434]
je 0x44924a
push 0x46a540
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpW]
test eax, eax
je 0x4492da
push 0x46ed6c
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpW]
test eax, eax
je 0x4492da
lea eax, [ebp - 0x434]
push eax
push esi
push str._s_s
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.0040397c
add esp, 0x14
lea eax, [ebp - 0x210]
mov ecx, 0x4b3d2c
push 1
push 1
push 0x46ed74
push eax
call fcn.0044915a
add edi, eax
jmp 0x4492da
push eax
push esi
push str._s_s
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.0040397c
add esp, 0x14
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
jne 0x4492d9
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 4]
jne 0x44927f
sub ecx, edx
sar ecx, 1
cmp ecx, dword [0x48bec0]
jae 0x4492d9
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
add eax, eax
push eax
lea eax, [ebp - 0x210]
push eax
push dword [0x48bebc]
call fcn.0043833c
add esp, 0xc
test eax, eax
je 0x4492d9
push 4
xor eax, eax
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
mov byte [0x4b3d2c], 1
inc edi
lea eax, [ebp - 0x460]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x4491cb
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
push esi
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test eax, eax
je 0x449305
inc edi
jmp 0x449344
mov ecx, esi
call fcn.00411b53
cmp eax, dword [0x48bec0]
jae 0x449344
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
add eax, eax
push eax
push esi
push dword [0x48bebc]
call fcn.0043833c
add esp, 0xc
test eax, eax
je 0x449344
push 4
xor eax, eax
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
mov byte [0x4b3d2c], 1
mov eax, edi
jmp 0x44934a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x449351
Capabilities:
Get file system object information
Query or enumerate registry value

Disassembly:
sub esp, 0x6bc
lea eax, [esp + 0x208]
push ebp
push esi
mov ebp, 0x2b4
push ebp
push 0
push eax
call fcn.0041c3f0
mov esi, dword [esp + 0x6d4]
add esp, 0xc
test esi, esi
je 0x4494c3
push edi
mov edi, dword [esp + 0x6d0]
test edi, edi
je 0x4494c2
push ebx
mov ebx, dword [esp + 0x6d8]
test ebx, ebx
je 0x4494c1
push 0x1000
xor eax, eax
mov word [edi], ax
lea eax, [esp + 0x21c]
or dword [ebx], 0xffffffff
push ebp
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ebp, dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea eax, [esp + 0x224]
push eax
call ebp
test eax, eax
jle 0x4493fe
push edi
call ebp
dec eax
shr eax, 1
je 0x4493f2
push SysReAllocString
lea ecx, [esp + 0x228]
mov edx, eax
push ecx
push ecx
mov ecx, edi
call fcn.004490ab
mov eax, dword [esp + 0x21c]
jmp 0x4494bf
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x200
push eax
lea eax, [esp + 0x4d0]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
push eax
push SysReAllocStringLen
call esi
push str.DefaultIcon
mov edx, 0x200
lea ecx, [esp + 0x4d0]
call fcn.004166b3
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x104
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x4d4]
push eax
push SysReAllocStringLen
call esi
lea eax, [esp + 0x18]
push 0x46a38c
push eax
call fcn.0041b6ce
mov dword [esp + 0x1c], eax
pop ecx
pop ecx
test eax, eax
je 0x4494c1
push eax
call ebp
xor esi, esi
inc esi
sub esi, eax
lea eax, [esp + 0x18]
push eax
call ebp
push edi
add esi, eax
call ebp
shr eax, 1
je 0x4494b1
shr esi, 1
cmp esi, 0x7ffffffe
jbe 0x4494a1
xor eax, eax
mov word [edi], ax
jmp 0x4494b1
push esi
lea ecx, [esp + 0x1c]
mov edx, eax
push ecx
push ecx
mov ecx, edi
call fcn.004490ab
mov eax, dword [esp + 0x14]
add eax, 2
push eax
call fcn.00429d81
pop ecx
mov dword [ebx], eax
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x6bc
ret 0xc
Function at 0x4494ce
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov esi, dword [ebp + 0xc]
push edi
test esi, esi
je 0x449608
cmp dword [ebp + 0x10], 0
je 0x449608
push 0x200
xor edi, edi
lea eax, [ebp - 0x208]
push edi
push eax
call fcn.0041c3f0
add esp, 0xc
mov dword [ebp + 0xc], edi
lea eax, [ebp + 0xc]
push eax
push 0x45a740
push 1
push edi
push 0x45a770
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x449608
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x449608
mov eax, dword [ebp + 0x20]
test eax, eax
jns 0x449550
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp - 0x208]
push eax
push esi
call fcn.00449351
mov eax, dword [ebp + 0x20]
mov edx, dword [ebp + 0xc]
cmp word [ebp - 0x208], di
mov ecx, dword [edx]
push eax
lea eax, [ebp - 0x208]
cmove eax, dword [ebp + 0x1c]
push eax
push edx
call dword [ecx + 0x44]
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 8]
push edx
push 0x100
mov dword [ebp - 8], edi
lea edx, [ebp - 0x208]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x40]
mov eax, dword [ebp + 0xc]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp + 0xc]
mov esi, 0x46293c
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp + 0xc]
push dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp + 0xc]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp + 0xc]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 4]
push edx
mov dword [ebp - 4], edi
push 0x45a780
mov eax, dword [ecx]
push ecx
call dword [eax]
mov esi, eax
test esi, esi
js 0x4495f6
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4495f6
mov eax, dword [ecx]
push 1
push dword [ebp + 0x10]
push ecx
call dword [eax + 0x18]
mov esi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
not esi
shr esi, 0x1f
mov eax, esi
jmp 0x44960a
xor eax, eax
pop edi
pop esi
leave
ret 0x1c
Function at 0x449610
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
test esi, esi
je 0x449781
cmp dword [ebp + 0x10], ebx
je 0x449781
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x449781
cmp dword [ebp - 4], ebx
je 0x449781
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0041c3f0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x449773
push edi
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
mov edi, 0x103
push eax
push str._s_s.lnk
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.0040397c
add esp, 0x14
mov dword [ebp + 0x10], ebx
lea eax, [ebp + 0x10]
push eax
push 0x45a740
push 1
push ebx
push 0x45a770
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x449772
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x449772
lea edx, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
mov eax, dword [ecx]
push edx
push 0x45a780
push ecx
call dword [eax]
test eax, eax
js 0x449752
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x449752
mov eax, dword [ecx]
lea edx, [ebp - 0x414]
push ebx
push edx
push ecx
call dword [eax + 0x14]
test eax, eax
js 0x449749
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x61c]
push edi
push edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x20]
test eax, eax
js 0x449749
lea eax, [ebp - 0x61c]
mov cx, word [esi]
cmp cx, word [eax]
jne 0x44973f
test cx, cx
je 0x449744
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x44973f
add esi, 4
add eax, 4
test cx, cx
jne 0x44971b
jmp 0x449744
sbb ebx, ebx
or ebx, 1
test ebx, ebx
sete bl
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test bl, bl
je 0x449772
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
neg eax
sbb al, al
and bl, al
pop edi
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
movzx eax, bl
jmp 0x449783
xor eax, eax
pop esi
pop ebx
leave
ret 0xc