joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100463e3
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x664
mov eax, dword [0x102de06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x664]
push esi
push 0x250
push 0
push eax
call fcn.100aa4a0
add esp, 0xc
lea eax, [ebp - 0x414]
push dword [ebp + 8]
push 0x104
push eax
call fcn.10046780
push ebx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10046568
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.10046780
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test byte [ebp - 0x664], 0x10
je 0x1004652c
mov ecx, 0x102c4dd4
lea eax, [ebp - 0x638]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100464b8
test dx, dx
je 0x100464b4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100464b8
add eax, 4
add ecx, 4
test dx, dx
jne 0x10046492
xor eax, eax
jmp 0x100464bd
sbb eax, eax
or eax, 1
test eax, eax
je 0x1004654b
mov ecx, 0x102c4c18
lea eax, [ebp - 0x638]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100464f6
test dx, dx
je 0x100464f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100464f6
add eax, 4
add ecx, 4
test dx, dx
jne 0x100464d0
xor eax, eax
jmp 0x100464fb
sbb eax, eax
or eax, 1
test eax, eax
je 0x1004654b
cmp byte [ebp + 0x10], 0
je 0x1004654b
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1004654b
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.100463e3
add esp, 0xc
jmp 0x1004654b
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1004654b
lea eax, [ebp - 0x20c]
push eax
call fcn.100463cb
pop ecx
lea eax, [ebp - 0x664]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10046452
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov al, 1
pop esi
xor ecx, ebp
pop ebx
call fcn.10039266
leave
ret
Function at 0x10046578
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push 0x2b4
mov eax, 0x102488a2
call fcn.10039bd9
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x40]
push esi
call fcn.10008a90
mov ecx, dword [ebp - 0x30]
xor ebx, ebx
mov dword [ebp - 4], ebx
test ecx, ecx
je 0x10046708
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
cmp word [eax + ecx*2 - 2], 0x5c
je 0x100465d6
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
cmp word [eax + ecx*2 - 2], 0x2f
je 0x100465d6
push 0x102c45d8
lea ecx, [ebp - 0x40]
call fcn.10004090
lea eax, [ebp - 0x40]
mov dword [ebp - 0x60], ebx
push eax
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x5c], ebx
call fcn.10008bc0
push 0x102530c0
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 1
call fcn.10004090
cmp dword [ebp - 0x5c], 8
lea ecx, [ebp - 0x2c0]
lea eax, [ebp - 0x70]
cmovae eax, dword [ebp - 0x70]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x10046700
xor eax, eax
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x294]
mov dword [ebp - 0x14], 7
push eax
call fcn.10008a60
push 0x102c4dd4
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.1004050d
test al, al
jne 0x100466c2
push 0x102c4c18
lea ecx, [ebp - 0x28]
call fcn.1004050d
test al, al
jne 0x100466c2
lea eax, [ebp - 0x40]
mov dword [ebp - 0x48], ebx
push eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x44], ebx
call fcn.10008bc0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x58]
push eax
mov byte [ebp - 4], 3
call fcn.10004020
test byte [ebp - 0x2c0], 0x10
lea eax, [ebp - 0x58]
je 0x100466ab
cmp dword [ebp - 0x44], 8
cmovae eax, dword [ebp - 0x58]
push eax
call fcn.10046578
jmp 0x100466b9
cmp dword [ebp - 0x44], 8
cmovae eax, dword [ebp - 0x58]
push eax
call fcn.100463cb
pop ecx
lea ecx, [ebp - 0x58]
call fcn.100094a0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.100094a0
lea eax, [ebp - 0x2c0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1004661d
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x10046700
push 4
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp - 0x70]
call fcn.100094a0
lea ecx, [ebp - 0x40]
call fcn.100094a0
call fcn.10039b83
ret
Function at 0x10046716
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
test eax, eax
je 0x10046779
xor edi, edi
cmp word [eax], di
je 0x10046779
push edi
push 0x80
push 2
push edi
push edi
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1004674f
pop edi
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1004676e
pop edi
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1004677c
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret
Function at 0x10046872
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push 0x430
mov eax, 0x102488d5
call fcn.10039bd9
mov ebx, dword [ebp + 8]
xor ecx, ecx
mov edi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 0x430], ebx
mov esi, ecx
mov dword [ebp - 0x434], edi
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x418], ecx
mov dword [ebp - 0x414], 7
mov word [ebp - 0x428], ax
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x428]
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstall_
call fcn.10004090
push ebx
lea ecx, [ebp - 0x428]
call fcn.10004090
cmp dword [ebp - 0x414], 8
lea ecx, [ebp - 0x42c]
push ecx
push 0x109
lea eax, [ebp - 0x428]
cmovae eax, dword [ebp - 0x428]
push esi
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1004698c
push 0x400
lea eax, [ebp - 0x410]
push esi
push eax
call fcn.100aa4a0
add esp, 0xc
mov dword [ebp - 0x438], 0x200
lea eax, [ebp - 0x438]
mov dword [ebp - 0x43c], 1
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x43c]
push eax
push esi
push str.UninstallString
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10046973
lea eax, [ebp - 0x410]
push eax
call ebx
test eax, eax
push 1
pop eax
cmovne esi, eax
cmp dword [ebp - 0x42c], 0
je 0x10046984
push dword [ebp - 0x42c]
call edi
test esi, esi
jne 0x10046a76
and dword [ebp - 0x418], 0
lea eax, [ebp - 0x428]
cmp dword [ebp - 0x414], 8
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
cmovae eax, dword [ebp - 0x428]
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x428]
call fcn.10004090
push dword [ebp - 0x430]
lea ecx, [ebp - 0x428]
call fcn.10004090
cmp dword [ebp - 0x414], 8
lea ecx, [ebp - 0x42c]
push ecx
push 0x109
lea eax, [ebp - 0x428]
cmovae eax, dword [ebp - 0x428]
push 0
push eax
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10046a76
push 0x400
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.100aa4a0
add esp, 0xc
mov dword [ebp - 0x434], 0x200
xor eax, eax
inc eax
mov dword [ebp - 0x430], eax
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x430]
push eax
push 0
push str.UninstallString
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10046a65
lea eax, [ebp - 0x410]
push eax
call ebx
test eax, eax
push 1
pop eax
cmovne esi, eax
cmp dword [ebp - 0x42c], 0
je 0x10046a76
push dword [ebp - 0x42c]
call edi
lea ecx, [ebp - 0x428]
call fcn.100094a0
mov eax, esi
call fcn.10039b83
ret
Function at 0x10046f0c
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x102de06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x10046f9f
push 0x228
xor esi, esi
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x22c]
push esi
push eax
call fcn.100aa4a0
add esp, 0xc
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x10046f9f
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x10046f88
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.1003f11f
pop ecx
pop ecx
test al, al
jne 0x10046f8e
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10046f68
jmp 0x10046f94
mov esi, dword [ebp - 0x228]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x10046fa1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10039266
leave
ret

Function at 0x10047225
Capabilities:
Check if file exists

Disassembly:
push 0x234
mov eax, 0x102489ac
call fcn.10039bd9
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push ebx
push 0x1a
push eax
push ebx
call fcn.1004798f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10047255
sub ecx, edx
sar ecx, 1
je 0x100472f0
push 0x102c45d8
mov ebx, 0x104
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.100d8ac8
push edi
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.100d8ac8
push 0x102c45d8
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.100d8ac8
add esp, 0x24
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100472e2
and dword [ebp - 0x21c], eax
and dword [ebp - 4], eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.10050f25
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
lea ecx, [ebp - 0x240]
call fcn.1001c8b0
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.10008a60
call fcn.10039b83
ret 8
Function at 0x10047477
Capabilities:
Check if file exists

Disassembly:
push 0xc7c
mov eax, 0x10248a2d
call fcn.10039bd9
mov esi, ecx
mov dword [ebp - 0xc88], esi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xc40]
mov ebx, dword [ebp + 0xc]
push 0x208
push 0
push eax
mov dword [ebp - 0xc84], edi
call fcn.100aa4a0
push 0x208
lea eax, [ebp - 0x830]
push 0
push eax
call fcn.100aa4a0
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.100aa4a0
push 0x208
lea eax, [ebp - 0xa38]
push 0
push eax
call fcn.100aa4a0
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.100aa4a0
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.100aa4a0
xor ecx, ecx
mov dword [ebp - 0xc44], 7
xor eax, eax
mov dword [ebp - 0xc48], ecx
add esp, 0x48
mov word [ebp - 0xc58], ax
push ecx
push 0x1a
lea eax, [ebp - 0xc40]
mov dword [ebp - 4], ecx
push eax
push ecx
mov ecx, esi
call fcn.1004798f
lea eax, [ebp - 0xc40]
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.100ca847
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.100ad586
add esp, 0x14
test eax, eax
jne 0x10047573
mov ecx, esi
jmp 0x100476e2
xor ecx, ecx
mov esi, 0x104
mov word [eax], cx
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x830]
push esi
push eax
call fcn.100ca847
push str.Local
lea eax, [ebp - 0x830]
push esi
push eax
call fcn.100d8ac8
add esp, 0x18
lea eax, [ebp - 0x830]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ecx, ecx
xor esi, esi
inc ecx
test eax, eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
cmovne esi, ecx
push 0x104
push eax
call fcn.100ca847
push str.LocalLow
lea eax, [ebp - 0x420]
push 0x104
push eax
call fcn.100d8ac8
add esp, 0x18
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push 1
xor ecx, ecx
test eax, eax
pop eax
cmovne ecx, eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xa38]
mov dword [ebp - 0xc84], ecx
push 0x104
push eax
call fcn.100ca847
push str.Roaming
lea eax, [ebp - 0xa38]
push 0x104
push eax
call fcn.100d8ac8
add esp, 0x18
lea eax, [ebp - 0xa38]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ecx, ecx
test eax, eax
push 1
pop eax
cmovne ecx, eax
test esi, esi
je 0x100476dc
cmp dword [ebp - 0xc84], 0
je 0x100476dc
test ecx, ecx
je 0x100476dc
push ebx
lea eax, [ebp - 0x420]
push eax
push 0x10253540
lea eax, [ebp - 0x628]
push 0x104
push eax
call fcn.10040ec0
add esp, 0x14
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100476c8
and dword [ebp - 0xc5c], eax
inc eax
mov byte [ebp - 4], al
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0x628]
push eax
call fcn.10050f25
pop ecx
pop ecx
lea ecx, [ebp - 0xc80]
mov byte [ebp - 4], 0
call fcn.1001c8b0
lea eax, [ebp - 0x628]
push eax
lea ecx, [ebp - 0xc58]
call fcn.10008a60
jmp 0x100476ef
mov ecx, dword [ebp - 0xc88]
push ebx
lea eax, [ebp - 0xc58]
push eax
call fcn.10047225
lea eax, [ebp - 0xc58]
mov ecx, edi
push eax
call fcn.100044a0
lea ecx, [ebp - 0xc58]
call fcn.100094a0
mov eax, edi
call fcn.10039b83
ret 8
Function at 0x100483f4
Capabilities:
Accept command line arguments

Disassembly:
push 0x24
mov eax, 0x10248bae
call fcn.10039bd9
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x30]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
call fcn.100489cc
and dword [ebp - 4], 0
test esi, esi
je 0x1004841c
push esi
jmp 0x10048423
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x30]
call fcn.10048ff1
lea ecx, [ebp - 0x30]
call fcn.100063a0
cmp eax, 1
jne 0x1004843f
call fcn.10048310
jmp 0x1004847e
push str._1382463573
lea ecx, [ebp - 0x30]
call fcn.100492ad
test al, al
jne 0x1004845c
lea eax, [ebp - 0x30]
push eax
call fcn.10048352
pop ecx
jmp 0x1004847e
test ebx, ebx
mov eax, 0x102c455c
cmovne eax, ebx
test edi, edi
push eax
mov eax, 0x102c4570
cmovne eax, edi
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.10048204
add esp, 0xc
lea ecx, [ebp - 0x30]
call fcn.100489fa
call fcn.10039b83
ret

Function at 0x10049671
Capabilities:
Create directory
Get common file path
Get startup folder

Disassembly:
push 0x224
mov eax, 0x10248dd7
call fcn.10039bd9
mov edi, dword [ebp + 8]
xor esi, esi
xor eax, eax
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], esi
push esi
push eax
call fcn.100aa4a0
add esp, 0xc
lea eax, [ebp - 0x218]
push esi
push 0xb
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x10049720
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.10008a60
push 0x102c45d8
lea ecx, [ebp - 0x230]
call fcn.10004090
push edi
lea ecx, [ebp - 0x230]
call fcn.10004090
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call fcn.100d8cb2
pop ecx
test eax, eax
je 0x1004971d
cmp eax, 0x11
jne 0x10049720
xor esi, esi
inc esi
lea ecx, [ebp - 0x230]
call fcn.100094a0
mov eax, esi
call fcn.10039b83
ret 4

Function at 0x10049b64
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0x224
mov eax, 0x10248dd7
call fcn.10039bd9
mov edi, dword [ebp + 8]
xor esi, esi
xor eax, eax
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], esi
push esi
push eax
call fcn.100aa4a0
add esp, 0xc
lea eax, [ebp - 0x218]
push esi
push 0xb
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x10049c08
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.10008a60
push 0x102c45d8
lea ecx, [ebp - 0x230]
call fcn.10004090
push edi
lea ecx, [ebp - 0x230]
call fcn.10004090
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call fcn.10046578
pop ecx
inc esi
lea ecx, [ebp - 0x230]
call fcn.100094a0
mov eax, esi
call fcn.10039b83
ret 4
Function at 0x10049cc2
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0x228
mov eax, 0x10248eca
call fcn.10039bd9
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
xor edi, edi
mov dword [ebp - 0x234], esi
push edi
push eax
call fcn.100aa4a0
xor eax, eax
mov dword [ebp - 0x220], edi
add esp, 0xc
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
push edi
push 0x1a
lea eax, [ebp - 0x218]
mov dword [ebp - 4], edi
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.10008a60
mov eax, dword [ebp - 0x220]
test eax, eax
je 0x10049d6d
dec eax
lea ecx, [ebp - 0x230]
push eax
call fcn.1004ab87
cmp word [eax], 0x5c
je 0x10049d5d
push 0x102c45d8
lea ecx, [ebp - 0x230]
call fcn.10004090
push str.MicrosoftInternet_ExplorerQuick_Launch
lea ecx, [ebp - 0x230]
call fcn.10004090
lea eax, [ebp - 0x230]
mov ecx, esi
push eax
call fcn.100044a0
lea ecx, [ebp - 0x230]
call fcn.100094a0
mov eax, esi
call fcn.10039b83
ret 4

Function at 0x10049d90
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0x258
mov eax, 0x10248f08
call fcn.10039bd9
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, dword [ebp + 0xc]
xor ecx, ecx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x264], edi
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], cx
push eax
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], ebx
call fcn.10008a90
push 0x208
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 1
push ebx
push eax
call fcn.100aa4a0
add esp, 0xc
lea eax, [ebp - 0x218]
push ebx
push dword [ebp + 0x14]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x10049e18
push 0x102c46e8
mov ecx, edi
call fcn.10008a90
jmp 0x10049ef0
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.10008a60
mov eax, dword [ebp - 0x220]
lea ecx, [ebp - 0x230]
dec eax
push eax
call fcn.1004ab87
cmp word [eax], 0x5c
je 0x10049e53
push 0x102c45d8
lea ecx, [ebp - 0x230]
call fcn.10004090
push esi
lea ecx, [ebp - 0x230]
call fcn.10004090
xor eax, eax
mov dword [ebp - 0x250], ebx
mov word [ebp - 0x260], ax
lea ecx, [ebp - 0x260]
mov eax, dword [ebp - 0x220]
sub eax, dword [ebp - 0x238]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x24c], 7
push eax
call fcn.10013040
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x260]
call fcn.100437db
lea ecx, [ebp - 0x260]
mov esi, eax
call fcn.100094a0
test esi, esi
je 0x10049ee2
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
push dword [ebp - 0x238]
cmovae eax, dword [ebp - 0x248]
lea ecx, [ebp - 0x230]
push eax
call fcn.10004020
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.100044a0
lea ecx, [ebp - 0x248]
call fcn.100094a0
lea ecx, [ebp - 0x230]
call fcn.100094a0
mov eax, edi
call fcn.10039b83
ret 0x10
Function at 0x1004a6dc
Capabilities:
Check if file exists

Disassembly:
push 0x4c
mov eax, 0x10248fd1
call fcn.10039bd9
mov ebx, ecx
mov edi, dword [ebp + 8]
xor esi, esi
push 7
pop ecx
xor eax, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ecx
mov word [ebp - 0x28], ax
mov dword [ebp - 4], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], ecx
mov word [ebp - 0x58], ax
push edi
mov byte [ebp - 4], 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1004a819
push edi
lea ecx, [ebp - 0x28]
call fcn.10008a60
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [ebp - 0x58]
call fcn.10008a60
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0x5c
cmovae eax, dword [ebp - 0x28]
push 0xffffffffffffffff
push dword [ebp - 0x18]
push eax
call fcn.1003a80e
add esp, 0x10
mov dword [ebp - 0x30], esi
xor ecx, ecx
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], cx
lea ecx, [ebp - 0x40]
push eax
push esi
lea eax, [ebp - 0x28]
push eax
call fcn.10013040
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.10009250
lea ecx, [ebp - 0x40]
call fcn.100094a0
call fcn.10053989
cmp eax, 1
jg 0x1004a7f3
lea eax, [ebp - 0x40]
mov ecx, ebx
push eax
call fcn.10049cc2
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
push dword [ebp - 0x48]
cmovae eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x40]
push eax
mov byte [ebp - 4], 2
call fcn.10004020
push str..lnk
lea ecx, [ebp - 0x40]
call fcn.10004090
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push esi
cmovae eax, dword [ebp - 0x40]
mov ecx, ebx
push esi
push esi
push 1
push esi
push esi
push eax
push edi
call fcn.10049563
lea ecx, [ebp - 0x40]
mov esi, eax
call fcn.100094a0
jmp 0x1004a819
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x58]
push 0x10253640
cmovae ecx, dword [ebp - 0x58]
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
push ecx
cmovae eax, dword [ebp - 0x28]
mov ecx, ebx
push eax
call fcn.10049f7b
mov esi, eax
lea ecx, [ebp - 0x58]
call fcn.100094a0
lea ecx, [ebp - 0x28]
call fcn.100094a0
mov eax, esi
call fcn.10039b83
ret 4
Function at 0x1004aa3c
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x4c
mov eax, 0x10248fd1
call fcn.10039bd9
mov edi, ecx
mov ebx, dword [ebp + 8]
xor esi, esi
push 7
pop ecx
xor eax, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ecx
mov word [ebp - 0x28], ax
mov dword [ebp - 4], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], ecx
mov word [ebp - 0x58], ax
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1004ab6d
push ebx
lea ecx, [ebp - 0x28]
call fcn.10008a60
push 8
pop ebx
cmp dword [ebp - 0x14], ebx
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [ebp - 0x58]
call fcn.10008a60
cmp dword [ebp - 0x14], ebx
lea eax, [ebp - 0x28]
push 0x5c
cmovae eax, dword [ebp - 0x28]
push 0xffffffffffffffff
push dword [ebp - 0x18]
push eax
call fcn.1003a80e
add esp, 0x10
mov dword [ebp - 0x30], esi
xor ecx, ecx
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], cx
lea ecx, [ebp - 0x40]
push eax
push esi
lea eax, [ebp - 0x28]
push eax
call fcn.10013040
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.10009250
lea ecx, [ebp - 0x40]
call fcn.100094a0
call fcn.10053989
cmp eax, 1
jg 0x1004ab49
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
call fcn.10049cc2
cmp dword [ebp - 0x44], ebx
lea eax, [ebp - 0x58]
push dword [ebp - 0x48]
cmovae eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x40]
push eax
mov byte [ebp - 4], 2
call fcn.10004020
push str..lnk
lea ecx, [ebp - 0x40]
call fcn.10004090
cmp dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x40]
mov esi, eax
call fcn.100094a0
jmp 0x1004ab6d
cmp dword [ebp - 0x44], ebx
lea ecx, [ebp - 0x58]
push 0x1025364c
cmovae ecx, dword [ebp - 0x58]
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], ebx
push ecx
cmovae eax, dword [ebp - 0x28]
mov ecx, edi
push eax
call fcn.10049f7b
mov esi, eax
lea ecx, [ebp - 0x58]
call fcn.100094a0
lea ecx, [ebp - 0x28]
call fcn.100094a0
mov eax, esi
call fcn.10039b83
ret 4