joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b4e5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004041e5
sub ebx, ebx
cmp dword [0x434898], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40b5ba
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x40b525
xor eax, eax
jmp 0x40b67e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40b51e
push eax
call fcn.00404182
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x434898], eax
call esi
push eax
call fcn.00404182
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43489c], eax
call esi
push eax
call fcn.00404182
mov dword [0x4348a0], eax
lea eax, [ebp - 8]
push eax
call fcn.004067af
or eax, eax
pop ecx
pop ecx
je 0x40b588
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40b5ba
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00404182
cmp eax, ebx
pop ecx
mov dword [0x4348a8], eax
je 0x40b5ba
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404182
pop ecx
mov dword [0x4348a4], eax
mov eax, dword [0x4348a4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40b633
cmp dword [0x4348a8], esi
je 0x40b633
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
je 0x40b600
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4348a8]
call fcn.004041ee
pop ecx
call eax
or eax, eax
je 0x40b600
test byte [ebp - 0x18], 1
jne 0x40b633
lea eax, [ebp - 0xc]
push eax
call fcn.004067e6
or eax, eax
pop ecx
je 0x40b61b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40b62a
or dword [ebp + 0x10], 0x200000
jmp 0x40b664
or dword [ebp + 0x10], 0x40000
jmp 0x40b664
mov eax, dword [0x43489c]
cmp eax, esi
je 0x40b664
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40b664
mov eax, dword [0x4348a0]
cmp eax, esi
je 0x40b664
push dword [ebp - 4]
push eax
call fcn.004041ee
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x434898]
call fcn.004041ee
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40193b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
xor esi, esi
call fcn.00407266
push eax
call fcn.00407429
sub byte [esi + 0x435a80], 0x56
pop ecx
call fcn.00407266
push eax
call fcn.00407429
add byte [esi + 0x435a80], 0x3c
pop ecx
call fcn.00407266
push eax
call fcn.00407429
add byte [esi + 0x435a80], 0xea
pop ecx
call fcn.00407266
push eax
call fcn.00407429
xor byte [esi + 0x435a80], 0xc3
pop ecx
call fcn.00407266
push eax
call fcn.00407429
add byte [esi + 0x435a80], 0xaf
pop ecx
call fcn.00407266
push eax
call fcn.00407429
xor byte [esi + 0x435a80], 0x65
pop ecx
call fcn.00407266
push eax
call fcn.00407429
add byte [esi + 0x435a80], 0xb3
pop ecx
call fcn.00407266
push eax
call fcn.00407429
add byte [esi + 0x435a80], 0x8f
pop ecx
call fcn.00407266
push eax
call fcn.00407429
xor byte [esi + 0x435a80], 0x30
pop ecx
call fcn.00407266
push eax
call fcn.00407429
xor byte [esi + 0x435a80], 0xfc
pop ecx
call fcn.00407266
push eax
call fcn.00407429
add byte [esi + 0x435a80], 0xe6
pop ecx
call fcn.00407266
push eax
call fcn.00407429
add byte [esi + 0x435a80], 0xa
pop ecx
call fcn.00407266
push eax
call fcn.00407429
add byte [esi + 0x435a80], 0x43
pop ecx
call fcn.00407266
push eax
call fcn.00407429
add byte [esi + 0x435a80], 0x40
inc esi
pop ecx
cmp esi, 0x23000
jb 0x401945
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401a61
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ebp, [esi + 0x10]
mov edi, dword [ebp]
mov ebx, edi
xor ebx, 0x14d
mov dword [esp + 0x18], ebp
cmp dword [esi + 0x14], 0x10
jb 0x401a84
mov esi, dword [esi]
shr edi, 2
push esi
push edi
push str._x_and__p
mov dword [esp + 0x20], edi
call fcn.004010d6
add esp, 0xc
test edi, edi
je 0x401ae1
mov ebp, esi
push 4
lea eax, [esp + 0x14]
push ebp
push eax
call fcn.0040a920
imul ecx, dword [esp + 0x1c], 0x5bd1e991
add esp, 0xc
imul ebx, ebx, 0x5bd1e991
add ebp, 4
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul eax, eax, 0x5bd1e991
xor ebx, eax
mov dword [esp + 0x10], eax
sub edi, 1
jne 0x401aa0
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp]
xor ecx, ecx
and eax, 3
sub eax, 1
je 0x401b0a
sub eax, 1
je 0x401b00
sub eax, 1
jne 0x401b18
movsx ecx, byte [esi + edi*4 + 2]
shl ecx, 0x10
movsx eax, byte [esi + edi*4 + 1]
shl eax, 8
xor ecx, eax
movsx eax, byte [esi + edi*4]
xor eax, ecx
imul eax, eax, 0x5bd1e991
xor ebx, eax
mov eax, ebx
shr eax, 0xd
xor eax, ebx
imul ecx, eax, 0x5bd1e991
pop edi
pop esi
pop ebp
pop ebx
mov eax, ecx
shr eax, 0xf
xor eax, ecx
add esp, 0xc
ret
Function at 0x401d20
Capabilities:
Delete file

Disassembly:
mov eax, 0x2024
call fcn.0044f150
mov eax, dword [0x485d30]
xor eax, esp
mov dword [esp + 0x2020], eax
push esi
mov esi, dword [esp + 0x202c]
xor eax, eax
test esi, esi
je 0x401db4
push 0x2000
mov dword [esp + 0xc], eax
push eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov word [esp + 0x28], ax
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x14], 3
call fcn.0044e220
push 0x1000
lea ecx, [esp + 0x34]
push esi
push ecx
call fcn.0044f1bb
add esp, 0x18
lea ecx, [esp + 4]
lea edx, [esp + 0x24]
mov eax, 0x614
push ecx
mov dword [esp + 0x10], edx
mov word [esp + 0x18], ax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb eax, eax
inc eax
mov ecx, dword [esp + 0x2024]
pop esi
xor ecx, esp
call fcn.0044e20c
add esp, 0x2024
ret

Function at 0x401f40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46b5bb
mov eax, dword fs:[0]
push eax
sub esp, 0x814
mov eax, dword [0x485d30]
xor eax, esp
mov dword [esp + 0x80c], eax
push esi
push edi
mov eax, dword [0x485d30]
xor eax, esp
push eax
lea eax, [esp + 0x820]
mov dword fs:[0], eax
mov eax, dword [0x487cf8]
mov edx, dword [eax + 0xc]
mov ecx, 0x487cf8
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
lea edi, [esp + 0x10]
mov dword [esp + 0x828], 0
call fcn.00402130
test eax, eax
jne 0x401fdf
mov dword [esp + 0x828], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401fd8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x40209b
push 0x800
lea ecx, [esp + 0x18]
push 0
push ecx
call fcn.0044e220
mov esi, dword [esp + 0x1c]
add esp, 0xc
push str.KWSMain.exe
push esi
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402025
lea edi, [ebx + 0xc]
lea eax, [esp + 0x10]
call fcn.00402b40
jmp 0x40206f
lea edi, [esp + 0x10]
call fcn.00402210
test eax, eax
je 0x401fad
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40206f
push 0x400
lea ecx, [esp + 0x18]
push esi
push ecx
call fcn.0044f1bb
add esp, 0xc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edi, [ebx + 0xc]
lea edx, [esp + 0x14]
call fcn.00402ae0
lea eax, [esi - 0x10]
mov dword [esp + 0x828], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402096
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x820]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x80c]
xor ecx, esp
call fcn.0044e20c
mov esp, ebp
pop ebp
ret
Function at 0x402130
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x814
mov eax, dword [0x485d30]
xor eax, esp
mov dword [esp + 0x80c], eax
push ebx
push esi
push 0x477680
xor ebx, ebx
mov eax, edi
call fcn.00402ba0
push 0x800
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.0044e220
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x10]
push eax
push 0x476e00
push str.SoftwareKingsoftKSWSVC
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 0x800
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov esi, eax
neg esi
sbb esi, esi
add esi, 1
je 0x4021f2
lea eax, [esp + 0x10]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4021b0
sub eax, edx
sar eax, 1
lea ecx, [esp + 0x10]
mov ebx, eax
push ecx
mov eax, edi
call fcn.00402ba0
mov ebx, edi
call fcn.00402f10
mov eax, 0x22
call fcn.00403030
mov eax, 0x5c
call fcn.00403030
call fcn.00402f90
call fcn.004030b0
mov ecx, dword [esp + 0x814]
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.0044e20c
add esp, 0x814
ret

Function at 0x402210
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x814
mov eax, dword [0x485d30]
xor eax, esp
mov dword [esp + 0x80c], eax
push ebx
push esi
push 0x477680
xor ebx, ebx
mov eax, edi
call fcn.00402ba0
push 0x800
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.0044e220
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x10]
push eax
push str.ImagePath
push str.SYSTEMCurrentControlSetServicesKingsoft_Antivirus_WebShield_Service
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 0x800
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov esi, eax
neg esi
sbb esi, esi
add esi, 1
je 0x4022d2
lea eax, [esp + 0x10]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402290
sub eax, edx
sar eax, 1
lea ecx, [esp + 0x10]
mov ebx, eax
push ecx
mov eax, edi
call fcn.00402ba0
mov ebx, edi
call fcn.00402f10
mov eax, 0x22
call fcn.00403030
mov eax, 0x5c
call fcn.00403030
call fcn.00402f90
call fcn.004030b0
mov ecx, dword [esp + 0x814]
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.0044e20c
add esp, 0x814
ret
Function at 0x402470
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x698
mov eax, dword [0x485d30]
xor eax, esp
mov dword [esp + 0x694], eax
mov eax, dword [ebp + 8]
push ebx
push edi
push 0x477514
push esi
xor edi, edi
push 0x477518
lea edx, [esp + 0x49c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], edi
call fcn.00402e20
add esp, 0xc
test eax, eax
je 0x4024cf
xor eax, eax
pop edi
pop ebx
mov ecx, dword [esp + 0x694]
xor ecx, esp
call fcn.0044e20c
mov esp, ebp
pop ebp
ret 4
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x494]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
je 0x4025b4
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
inc edi
test byte [esp + 0x38], 0x10
je 0x402572
cmp word [esp + 0x64], 0x2e
jne 0x40251d
mov ax, word [esp + 0x66]
test ax, ax
je 0x402572
cmp ax, 0x2e
jne 0x40251d
cmp word [esp + 0x68], 0
je 0x402572
lea eax, [esp + 0x64]
push eax
push esi
lea ecx, [esp + 0x290]
push ecx
call ebx
test eax, eax
je 0x402572
push str.kwsmain.exe
lea edx, [esp + 0x28c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x402572
lea eax, [esp + 0x14]
push eax
push 0
lea ecx, [esp + 0x290]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x402572
test byte [esp + 0x14], 0x10
jne 0x402572
cmp dword [esp + 0x34], 0x1000
ja 0x402594
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x38]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4025a9
cmp edi, 0x3e8
jl 0x4024f5
jmp 0x4025a9
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x64]
push ecx
push esi
push edx
call ebx
mov dword [esp + 8], 1
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x69c]
mov eax, dword [esp + 8]
pop edi
pop ebx
xor ecx, esp
call fcn.0044e20c
mov esp, ebp
pop ebp
ret 4
Function at 0x4025d0
Capabilities:
Enumerate process modules
Suspend thread

Disassembly:
sub esp, 0x43c
mov eax, dword [0x485d30]
xor eax, esp
mov dword [esp + 0x434], eax
cmp dword [0x4891e0], 0
push esi
push edi
mov esi, ecx
jne 0x402615
push str.NtQueryInformationThread
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4891e0], eax
test eax, eax
je 0x4026d3
push esi
push 0
push 0x42
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x4026d3
push 0
push 4
lea eax, [esp + 0x14]
push eax
push 9
push edi
call dword [0x4891e0]
test eax, eax
je 0x40265e
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov ecx, dword [esp + 0x434]
xor ecx, esp
call fcn.0044e20c
add esp, 0x43c
ret
push ebx
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x402640
lea ecx, [esp + 0x10]
push ecx
push esi
mov dword [esp + 0x18], 0x428
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x4026c7
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0xc]
cmp eax, ecx
ja 0x4026af
mov edx, dword [esp + 0x28]
add edx, eax
cmp edx, ecx
jbe 0x4026af
lea eax, [esp + 0x30]
push str.kswebshield.dll
push eax
call fcn.0044f048
add esp, 8
test eax, eax
je 0x4026c0
lea ecx, [esp + 0x10]
push ecx
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x402683
jmp 0x4026c7
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
mov ecx, dword [esp + 0x43c]
pop edi
pop esi
xor ecx, esp
call fcn.0044e20c
add esp, 0x43c
ret

Function at 0x4026f0
Capabilities:
Enumerate threads
Find taskbar

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push ebx
push esi
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x402779
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x10], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 8]
test eax, eax
je 0x402779
push eax
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x402779
lea edx, [esp + 0xc]
push edx
push esi
mov dword [esp + 0x14], 0x1c
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x402772
lea ecx, [ecx]
mov ebx, dword [esp + 8]
cmp dword [esp + 0x18], ebx
jne 0x402763
mov ecx, dword [esp + 0x14]
call fcn.004025d0
lea eax, [esp + 0xc]
push eax
push esi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x402750
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402780
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
sub esp, 0x61c
mov eax, dword [0x485d30]
xor eax, esp
mov dword [esp + 0x618], eax
mov eax, dword [esp + 0x620]
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push esi
mov esi, ecx
test eax, eax
je 0x402801
cmp word [eax], 0
je 0x402801
push esi
push eax
lea eax, [esp + 0x218]
push eax
call ebx
test eax, eax
je 0x402801
lea ecx, [esp + 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402801
lea edx, [esp + 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x210]
push 0x4775a8
push eax
call fcn.0045015f
add esp, 8
test eax, eax
je 0x402801
push eax
call fcn.0044fa63
add esp, 4
push esi
push edi
lea ecx, [esp + 0x10]
push ecx
call ebx
test eax, eax
je 0x402857
lea edx, [esp + 8]
push edx
push str._s.tmp
lea edx, [esp + 0x420]
call fcn.00402e20
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
add esp, 8
push 1
lea eax, [esp + 0x41c]
push eax
lea ecx, [esp + 0x10]
push ecx
call esi
push 4
push 0
lea edx, [esp + 0x10]
push edx
call esi
push 4
push 0
lea eax, [esp + 0x420]
push eax
call esi
mov ecx, dword [esp + 0x620]
pop esi
pop ebx
xor ecx, esp
call fcn.0044e20c
add esp, 0x61c
ret 4
Function at 0x402930
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x82c
mov eax, dword [0x485d30]
xor eax, esp
mov dword [esp + 0x828], eax
mov ecx, dword [0x4775f0]
mov edx, dword [0x4775f4]
mov eax, dword [0x4775ec]
push ebx
push esi
mov dword [esp + 0x820], ecx
movzx ecx, word [0x4775fc]
push edi
mov dword [esp + 0x828], edx
mov edx, dword [0x476e4c]
mov dword [esp + 0x820], eax
mov eax, dword [0x4775f8]
mov word [esp + 0x830], cx
movzx ecx, word [0x476e54]
push 0x800
mov dword [esp + 0x818], edx
mov dword [esp + 0x830], eax
mov eax, dword [0x476e50]
lea edx, [esp + 0x14]
push 0
push edx
mov dword [esp + 0x824], eax
mov word [esp + 0x828], cx
call fcn.0044e220
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
add esp, 0xc
push 1
push 0x10
lea eax, [esp + 0x18]
push eax
push 0
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [esp + 0x820]
push ecx
lea edx, [esp + 0x14]
push edx
mov eax, edx
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x10]
push ecx
call ebx
push 1
push 0x19
lea edx, [esp + 0x18]
push edx
push 0
call esi
lea eax, [esp + 0x820]
push eax
lea ecx, [esp + 0x14]
push ecx
mov edx, ecx
push edx
call edi
lea eax, [esp + 0x10]
push eax
call ebx
push 1
push 0x1a
lea ecx, [esp + 0x18]
push ecx
push 0
call esi
push str.MicrosoftInternet_ExplorerQuick_Launch_
lea edx, [esp + 0x14]
push edx
mov eax, edx
push eax
call edi
lea ecx, [esp + 0x10]
push ecx
call ebx
push 1
push 0xb
lea edx, [esp + 0x18]
push edx
push 0
call esi
lea eax, [esp + 0x814]
push eax
lea ecx, [esp + 0x14]
push ecx
mov edx, ecx
push edx
call edi
lea eax, [esp + 0x10]
push eax
call fcn.00401d20
add esp, 4
push 1
push 0x16
lea ecx, [esp + 0x18]
push ecx
push 0
call esi
lea edx, [esp + 0x814]
push edx
lea eax, [esp + 0x14]
push eax
mov ecx, eax
push ecx
call edi
lea edx, [esp + 0x10]
push edx
call fcn.00401d20
mov ecx, dword [esp + 0x838]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0044e20c
mov esp, ebp
pop ebp
ret
Function at 0x4032d0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x110c
call fcn.0044f150
mov eax, dword [0x485d30]
xor eax, esp
mov dword [esp + 0x1108], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x800
lea ecx, [esp + 0x914]
push 0
push ecx
mov dword [esp + 0x18], eax
call fcn.0044e220
add esp, 0xc
push 0x800
lea edx, [esp + 0x114]
push 0
push edx
call fcn.0044e220
add esp, 0xc
lea eax, [esp + 0x910]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x100
lea ecx, [esp + 0x14]
push 0
push ecx
call fcn.0044e220
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
xor esi, esi
jmp 0x403360
lea edx, [esp + 0x10]
push 0x80
push edx
call fcn.004031e0
add esp, 8
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x914]
push ecx
lea edx, [esp + 0x118]
push edx
call ebx
lea eax, [esp + 0x110]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x403393
mov ecx, dword [str..tmp]
mov edx, dword [0x47770c]
mov dword [eax], ecx
mov cx, word [0x477710]
mov dword [eax + 4], edx
lea edx, [esp + 0x110]
push edx
mov word [eax + 8], cx
call edi
test eax, eax
je 0x4033e6
inc esi
cmp esi, 0xa
jl 0x403360
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1108]
xor ecx, esp
call fcn.0044e20c
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x110]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4033f0
sub eax, edx
sar eax, 1
lea ecx, [esp + 0x110]
mov ebx, eax
mov eax, dword [esp + 0xc]
push ecx
call fcn.00402ba0
mov ecx, dword [esp + 0x1114]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0044e20c
mov esp, ebp
pop ebp
ret

Function at 0x403430
Capabilities:
Create thread

Disassembly:
cmp dword [esp + 0x10], 0
mov edx, dword [esp + 8]
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x14]
mov dword [esi + 0xc], edi
mov edi, dword [esp + 0x1c]
mov dword [esi + 0x10], edi
mov edi, dword [esp + 0x20]
lea eax, [esi + 8]
mov dword [esi], vtable.CSimpleThread.0
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], edx
mov dword [esi + 4], 0
mov dword [eax], 0xffffffff
mov dword [esi + 0x14], edi
je 0x40348c
test ecx, ecx
je 0x40348c
push eax
push 0
push edx
push ecx
push 0
push 0
call fcn.004506de
add esp, 0x18
mov dword [esi + 4], eax
pop edi
mov eax, esi
pop esi
ret 0x18
Function at 0x4038c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x18]
xor eax, eax
push esi
push edi
mov edi, dword [esp + 0x14]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x1c]
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x4038ef
pop edi
pop esi
pop ebx
ret 0x14
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push edi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40390d
pop ebp
pop edi
pop esi
pop ebx
ret 0x14
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebx + 4], ebp
pop ebp
pop edi
mov dword [ebx], eax
pop esi
mov eax, 1
pop ebx
ret 0x14

Function at 0x403930
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46bb90
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
mov eax, dword [0x485d30]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov dword [esp + 0x14], vtable.CResourceUnpack.0
mov edx, dword [esp + 0x38]
xor ebx, ebx
mov dword [esp + 0x28], ebx
mov ecx, dword [esp + 0x3c]
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [0x4891e8]
push edx
mov edx, dword [ecx + 0x28]
push eax
push 0x4891e8
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call edx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
cmp eax, ebx
je 0x4039f7
mov eax, dword [0x487cf8]
mov edx, dword [eax + 0xc]
mov ecx, 0x487cf8
call edx
add eax, 0x10
mov dword [esp + 0x3c], eax
push 1
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0x34], 1
call fcn.0040d860
test eax, eax
jne 0x403a0d
mov byte [esp + 0x28], bl
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4039f7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x20
ret 0x18
mov esi, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
mov eax, esi
sub edx, esi
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x403a20
lea eax, [esi - 0x10]
mov byte [esp + 0x28], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403a4f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x20
ret 0x18