joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f5be
Capabilities:
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x7b4]
sub esp, 0x834
mov eax, dword [0x431420]
xor eax, ebp
mov dword [ebp + 0x7b0], eax
mov eax, dword [ebp + 0x7c0]
and dword [ebp - 0x74], 0
push ebx
mov ebx, dword [ebp + 0x7bc]
push esi
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x7c8]
push edi
mov edi, dword [ebp + 0x7c4]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x7cc]
mov esi, 0x40f
push esi
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x6f]
push 0
push eax
mov byte [ebp - 0x70], 0
call fcn.00413c80
push esi
lea eax, [ebp + 0x3a1]
push 0
push eax
mov byte [ebp + 0x3a0], 0
call fcn.00413c80
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
push dword [ebp - 0x78]
mov edi, 0x429120
push ebx
lea eax, [ebp - 0x70]
push edi
push eax
call esi
push dword [ebp - 0x7c]
lea eax, [ebp + 0x3a0]
push dword [ebp - 0x78]
push ebx
push edi
push eax
call esi
add esp, 0x40
xor esi, esi
inc esi
push esi
lea eax, [ebp + 0x3a0]
push eax
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x40f6b0
push str.___MoveFile:_MoveFile___failed__trying_MoveFileOnReboot__.
call fcn.0040ca21
lea eax, [ebp + 0x3a0]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.0040f300
add esp, 0xc
test eax, eax
je 0x40f69e
mov eax, dword [ebp - 0x80]
mov dword [eax], esi
jmp 0x40f6b0
push str.___MoveFile:_MoveFileOnReboot___failed.
call fcn.0040ca21
pop ecx
mov dword [ebp - 0x74], 0x65b
mov ecx, dword [ebp + 0x7b0]
mov eax, dword [ebp - 0x74]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004141fb
add ebp, 0x7b4
leave
ret

Function at 0x40f6cb
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push 0x44
xor esi, esi
lea eax, [ebp - 0x54]
push esi
push eax
xor ebx, ebx
call fcn.00413c80
push 0x10
lea eax, [ebp - 0x10]
push esi
push eax
mov dword [ebp - 0x54], 0x44
call fcn.00413c80
add esp, 0x18
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push 1
push esi
push esi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40f720
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x40f730
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x40f736
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x431420]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x40f7b5
lea eax, [ebp - 0x12c]
push eax
push esi
mov dword [ebp - 0x12c], 0x128
call sub.KERNEL32.dll_Process32First
jmp 0x40f7aa
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.00421d8e
pop ecx
pop ecx
test eax, eax
jne 0x40f79d
push dword [ebp + 0xc]
push 0x1388
push dword [ebp - 0x124]
call fcn.0040f27a
lea eax, [ebp - 0x12c]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40f777
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004141fb
leave
ret

Function at 0x40f7c5
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push str.SOFTWAREJavaSoft
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40f7fd
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x40f81d
Capabilities:
Create process on windows

Disassembly:
push str.Restart_IE
call fcn.0040ca21
pop ecx
push 1
push 0
push str.http:__java.com_verify
push str.iexplore
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret
Function at 0x40f844
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x590]
sub esp, 0x610
mov eax, dword [0x431420]
xor eax, ebp
mov dword [ebp + 0x58c], eax
push ebx
push esi
push edi
mov edi, 0x103
xor ebx, ebx
push edi
lea eax, [ebp + 0x385]
push ebx
push eax
mov byte [ebp + 0x384], bl
call fcn.00413c80
lea esi, [edi + 1]
push esi
lea eax, [ebp + 0x384]
push eax
push str.1.7.0_09
call fcn.0040bda7
add esp, 0x18
test eax, eax
jne 0x40f8be
push str.Cannot_determine_JavaHome._n
call fcn.0040ca21
pop ecx
xor eax, eax
mov ecx, dword [ebp + 0x58c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004141fb
add ebp, 0x590
leave
ret
push edi
lea eax, [ebp + 0x489]
push ebx
push eax
mov byte [ebp + 0x488], bl
call fcn.00413c80
push str.libdeployment.properties
lea eax, [ebp + 0x384]
push eax
push str._s_s
push 0xffffffffffffffff
lea eax, [ebp + 0x488]
push esi
push eax
call fcn.00416353
lea eax, [ebp + 0x488]
push eax
call fcn.0040ed60
add esp, 0x28
test eax, eax
je 0x40f90c
push str.Deployment_configuration_files_already_exists._n
jmp 0x40f89e
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp + 0x488]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40f939
push str.Unable_to_create_deployment_configuration_file._n
jmp 0x40f89e
push 0x3ff
lea eax, [ebp - 0x7b]
push ebx
push eax
mov byte [ebp - 0x7c], bl
call fcn.00413c80
push str.deployment.baseline.url_n
push 0xffffffffffffffff
lea eax, [ebp - 0x7c]
push 0x400
push eax
call fcn.00416353
add esp, 0x1c
push ebx
push ebx
push ebx
push esi
mov dword [ebp - 0x80], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40f9a8
push str.Unable_to_write_to_deployment_configuration_file._n
call fcn.0040ca21
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x40f8a6
push str.Successfully_disabled_dynamic_baselining._n
call fcn.0040ca21
xor ebx, ebx
inc ebx
jmp 0x40f999

Function at 0x4100e9
Capabilities:
Create directory

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
call fcn.0040beb1
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop ecx
xor ebp, ebp
push ebp
push esi
call ebx
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push esi
push str._sSun_
push esi
call edi
add esp, 0xc
push ebp
push esi
call ebx
push esi
push str._sJava_
push esi
call edi
add esp, 0xc
push ebp
push esi
call ebx
cmp dword [esp + 0x18], ebp
push str.1.7.0_09
mov ebp, 0x427968
push ebp
push esi
je 0x410143
push str._s_s_s_x64
jmp 0x410148
push str._s_s_s
push esi
call edi
add esp, 0x14
push 0
push esi
call ebx
push str.1.7.0_09
push ebp
push esi
push str._s_s_s.msi
push esi
call edi
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4102fc
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x3fc
cmp word [esp + 8], ax
jne 0x41033a
push esi
push 0x100
lea esi, [ecx + 0x434]
push esi
push 0x7f4
push dword [0x432e08]
call dword [sym.imp.USER32.dll_LoadStringA]
push 1
xor eax, eax
push eax
push eax
push esi
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop esi
xor eax, eax
ret 0x10

Function at 0x41033f
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x3ff
cmp word [esp + 8], ax
jne 0x41037d
push esi
push 0x100
lea esi, [ecx + 0x434]
push esi
push 0x7f3
push dword [0x432e08]
call dword [sym.imp.USER32.dll_LoadStringA]
push 1
xor eax, eax
push eax
push eax
push esi
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop esi
xor eax, eax
ret 0x10

Function at 0x410412
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x290]
sub esp, 0x310
mov eax, dword [0x431420]
xor eax, ebp
mov dword [ebp + 0x28c], eax
push ebx
push esi
push edi
mov esi, 0xff
xor ebx, ebx
push esi
lea eax, [ebp - 0x73]
push ebx
push eax
mov dword [ebp - 0x80], ecx
mov byte [ebp - 0x74], bl
call fcn.00413c80
push esi
lea eax, [ebp + 0x8d]
push ebx
push eax
mov byte [ebp + 0x8c], bl
call fcn.00413c80
push esi
lea eax, [ebp + 0x18d]
push ebx
push eax
mov byte [ebp + 0x18c], bl
call fcn.00413c80
add esp, 0x24
lea edi, [esi + 1]
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
push edi
lea eax, [ebp - 0x74]
push eax
push 0x7fa
push dword [0x432e0c]
call esi
push edi
lea eax, [ebp + 0x8c]
push eax
push 0x7fb
push dword [0x432e0c]
call esi
push str.1.7.0_09
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x18c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [ebp - 0x80]
add esp, 0xc
push 0x134
lea eax, [ebp + 0x8c]
push eax
lea eax, [ebp + 0x18c]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x41054e
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SOFTWAREJavaSoft
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x7c], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edi, str.decline
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push edi
push 1
push ebx
push str.InstallStatus
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, esi
call fcn.00410382
movzx eax, word [ebp + 0x29c]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
mov ecx, dword [ebp + 0x28c]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004141fb
add ebp, 0x290
leave
ret 0x10

Function at 0x410f1d
Capabilities:
Create process on windows

Disassembly:
mov eax, 0xbe1
cmp word [esp + 8], ax
jne 0x410f5b
push esi
push 0x100
lea esi, [ecx + 0x440]
push esi
push 0x80f
push dword [0x432e08]
call dword [sym.imp.USER32.dll_LoadStringA]
push 1
xor eax, eax
push eax
push eax
push esi
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop esi
xor eax, eax
ret 0x10
Function at 0x411bcd
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0xd8]
sub esp, 0x158
mov eax, dword [0x431420]
xor eax, ebp
mov dword [ebp + 0xd4], eax
mov eax, dword [ebp + 0xe4]
push ebx
push esi
mov esi, dword [ebp + 0xe0]
push edi
push esi
mov dword [ebp - 0x78], eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 2
push esi
mov dword [ebp - 0x74], eax
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
push 1
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_ModifyWorldTransform]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push esi
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
push 0x5a
push esi
fstp dword [ebp - 0x70]
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
fstp dword [ebp - 0x6c]
fld dword [ebp - 0x70]
fmul qword [0x4295e8]
fld qword [0x4295e0]
fdiv st(1), st(0)
fxch st(1)
call fcn.00417920
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xe8]
imul eax, eax, 0xa
mov dword [ebp - 0x70], eax
fild dword [ebp - 0x70]
fmul dword [ebp - 0x6c]
fdivrp st(1)
call fcn.00417920
mov dword [ebp - 0x7c], eax
push 1
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.GDI32.dll_DPtoLP]
fild dword [ebp - 0x7c]
push ecx
push ecx
fstp qword [esp]
call fcn.004177e1
fdiv qword [0x4295d8]
pop ecx
pop ecx
fadd qword [0x4295d0]
call fcn.00417920
neg eax
cmp dword [ebp + 0xf0], ebx
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0xec]
mov dword [ebp - 0x58], eax
setne al
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov byte [ebp - 0x54], bl
mov byte [ebp - 0x53], al
push 0x100
lea eax, [ebp - 0x2c]
push eax
push 0x1002
push 0x800
mov dword [ebp - 0x52], ebx
mov word [ebp - 0x4e], bx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 5
lea eax, [ebp - 0x2c]
push str.Japan
push eax
call fcn.00416795
add esp, 0xc
test eax, eax
lea eax, [ebp - 0x4c]
je 0x411d18
push dword [ebp - 0x78]
jmp 0x411d1d
push str.MS_UI_Gothic
push eax
call fcn.00413d00
pop ecx
pop ecx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push dword [ebp - 0x74]
mov edi, eax
push esi
call dword [sym.imp.GDI32.dll_RestoreDC]
mov ecx, dword [ebp + 0xd4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004141fb
add ebp, 0xd8
leave
ret 0x14
Function at 0x412199
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0xd5e5e7
mov esi, ecx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
xor edi, edi
push 0xfa5
push dword [esi + 4]
mov dword [esi + 0x868], eax
mov dword [esi + 0x834], edi
mov dword [esi + 0x85c], edi
mov dword [esi + 0x854], edi
mov dword [esi + 0x858], edi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, dword [sym.imp.USER32.dll_PostMessageA]
push 0xffffff
push edi
push 0x2001
push eax
mov dword [ebp - 4], eax
call ebx
push 0x32cd32
push edi
push 0x409
push dword [ebp - 4]
call ebx
push 0xfffffffffffffff0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
and eax, 0xfffeffff
push eax
push 0xfffffffffffffff0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowLongA]
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetSystemMenu]
push 1
push 0xf060
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
lea eax, [ebp - 8]
push eax
push edi
push esi
push 0x411e8c
push edi
push edi
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x412d3f
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x3d8]
sub esp, 0x458
mov eax, dword [0x431420]
xor eax, ebp
mov dword [ebp + 0x3d4], eax
mov eax, dword [ebp + 0x3e4]
push ebx
push esi
mov esi, dword [ebp + 0x3e0]
push edi
push esi
mov dword [ebp - 0x78], eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 2
push esi
mov dword [ebp - 0x74], eax
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
push 1
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_ModifyWorldTransform]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push esi
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
push 0x5a
push esi
fstp dword [ebp - 0x70]
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
fstp dword [ebp - 0x6c]
fld dword [ebp - 0x70]
fmul qword [0x4295e8]
fld qword [0x4295e0]
fdiv st(1), st(0)
fxch st(1)
call fcn.00417920
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x3e8]
imul eax, eax, 0xa
mov dword [ebp - 0x70], eax
fild dword [ebp - 0x70]
fmul dword [ebp - 0x6c]
fdivrp st(1)
call fcn.00417920
mov dword [ebp - 0x7c], eax
push 1
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.GDI32.dll_DPtoLP]
fild dword [ebp - 0x7c]
push ecx
push ecx
fstp qword [esp]
call fcn.004177e1
fdiv qword [0x4295d8]
fadd qword [0x4295d0]
call fcn.00417920
neg eax
cmp dword [ebp + 0x3f0], ebx
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x3ec]
mov dword [ebp - 0x58], eax
setne al
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov byte [ebp - 0x54], bl
mov byte [ebp - 0x53], al
mov dword [ebp - 0x52], ebx
mov word [ebp - 0x4e], bx
push 0x3ff
lea eax, [ebp - 0x2b]
push ebx
push eax
mov byte [ebp - 0x2c], bl
call fcn.00413c80
add esp, 0x14
push 0x400
lea eax, [ebp - 0x2c]
push eax
push 0x1002
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 5
lea eax, [ebp - 0x2c]
push str.Japan
push eax
call fcn.00416795
add esp, 0xc
test eax, eax
lea eax, [ebp - 0x4c]
je 0x412e9d
push dword [ebp - 0x78]
jmp 0x412ea2
push str.MS_UI_Gothic
push eax
call fcn.00413d00
pop ecx
pop ecx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push dword [ebp - 0x74]
mov edi, eax
push esi
call dword [sym.imp.GDI32.dll_RestoreDC]
mov ecx, dword [ebp + 0x3d4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004141fb
add ebp, 0x3d8
leave
ret 0x14
Function at 0x412edc
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
lea ebp, [esp - 0x9b4]
sub esp, 0xa34
mov eax, dword [0x431420]
xor eax, ebp
mov dword [ebp + 0x9b0], eax
mov eax, dword [ebp + 0x9c4]
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push dword [esi + 4]
mov dword [ebp - 0x60], eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x7c]
push 0x103
rep stosd dword es:[edi], eax
lea eax, [ebp + 0x7a9]
push ebx
push eax
mov byte [ebp + 0x7a8], bl
call fcn.00413c80
mov edi, 0x3ff
push edi
lea eax, [ebp - 0x57]
push ebx
push eax
mov byte [ebp - 0x58], bl
call fcn.00413c80
mov eax, dword [ebp - 0x60]
add esp, 0x18
push 0x400
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x58]
push eax
push 0x7fe
push dword [0x432e0c]
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x58]
mov dword [ebp - 0x74], eax
lea eax, [ebp + 0x7a8]
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x5c]
push eax
push ebx
push ebx
push 0x11
push dword [ebp - 0x60]
mov dword [ebp - 0x70], 0x49
mov dword [ebp - 0x5c], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
jne 0x412f9d
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
mov dword [ebp - 0x5c], eax
cmp eax, ebx
je 0x413050
push 0x103
lea eax, [ebp + 0x8ad]
push ebx
push eax
mov byte [ebp + 0x8ac], bl
call fcn.00413c80
add esp, 0xc
lea eax, [ebp + 0x8ac]
push eax
push dword [ebp - 0x5c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x413047
lea ecx, [ebp + 0x8ac]
lea eax, [esi + 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
lea eax, [ebp + 0x3a9]
push ebx
push eax
mov byte [ebp + 0x3a8], bl
call fcn.00413c80
lea eax, [ebp + 0x8ac]
push eax
lea eax, [ebp + 0x3a8]
push str.Selected_Folder:__s_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp + 0x3a8]
push eax
call fcn.0040ca21
add esp, 0x1c
push 0x408
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [esi + 0x28]
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push dword [ebp - 0x5c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [ebp + 0x9b0]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004141fb
add ebp, 0x9b4
leave
ret 0x10
Function at 0x413851
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x432e3c], 0
push esi
push edi
jne 0x4137c7
call fcn.00413733
test eax, eax
je 0x41380c
mov eax, dword [0x432e3c]
cmp eax, 1
jne 0x4137e8
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x41380c
jmp 0x41384e
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x41384e
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x413810
xor eax, eax
jmp 0x41384e
mov eax, dword [esi]
push dword [0x432e3c]
call edi
mov edi, eax
test edi, edi
je 0x413832
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x41384e
lea edi, [esi + 0xff0]
push esi
push dword [0x432e3c]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x413838
mov eax, esi
pop edi
pop esi
ret
jmp 0x4137b3

Function at 0x4141fb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x431420]
jne 0x414205
repz ret
jmp fcn.0041823f
Function at 0x41e9d9
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x431420]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004193cb
and dword [ebp - 0x14], 0
cmp dword [0x433c2c], 0
mov dword [ebp - 0x18], eax
jne 0x41ea8c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41eb34
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41eb34
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x42b094
push ebx
mov dword [0x433c2c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x433c30], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x433c34], eax
call edi
push eax
call esi
mov dword [0x433c3c], eax
test eax, eax
je 0x41ea8c
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x433c38], eax
mov eax, dword [0x433c38]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41eae5
cmp dword [0x433c3c], ecx
je 0x41eae5
push eax
call esi
push dword [0x433c3c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41eae5
test ebx, ebx
je 0x41eae5
call edi
test eax, eax
je 0x41eadc
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41eadc
test byte [ebp - 8], 1
jne 0x41eae5
or dword [ebp + 0x10], 0x200000
jmp 0x41eb18
mov eax, dword [0x433c30]
cmp eax, dword [ebp - 0x18]
je 0x41eb18
push eax
call esi
test eax, eax
je 0x41eb18
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41eb18
mov eax, dword [0x433c34]
cmp eax, dword [ebp - 0x18]
je 0x41eb18
push eax
call esi
test eax, eax
je 0x41eb18
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x433c2c]
call esi
test eax, eax
je 0x41eb34
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41eb36
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004141fb
leave
ret