joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f17a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x48a0f8]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebx, ebx
push str.kernel32.dll
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ebx
xor esi, esi
call edi
push str.GetUserDefaultUILanguage
push eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x45f21c
call eax
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ebx, 0x3ff
mov edi, 0xfc00
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ecx, cx
and eax, edi
or eax, ecx
push eax
mov dword [ebp - 0x1c], ecx
call esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
call esi
push str.GetSystemDefaultUILanguage
push dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ebx, cx
and eax, edi
or eax, ebx
push eax
call esi
push ebx
mov dword [ebp - 0x34], eax
call esi
mov dword [ebp - 0x30], eax
push 4
xor ebx, ebx
jmp 0x45f31e
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x45f2cc
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push str.Control_PanelDesktopResourceLocale
push SysReAllocStringLen
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x45f31f
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x45f2c1
cmp dword [ebp - 0x24], 1
jne 0x45f2c1
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push 0x475308
push eax
call fcn.00413f0d
add esp, 0xc
cmp eax, 1
jne 0x45f2c1
mov eax, dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
push 2
mov dword [ebp - 0x38], eax
pop esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x45f31f
push str.ntdll.dll
call edi
cmp eax, ebx
je 0x45f31f
lea ecx, [ebp - 0x18]
push ecx
push 0x45f164
push 1
push 0x10
push eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
cmp word [ebp - 0x18], bx
je 0x45f31f
movzx eax, word [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
mov dword [ebp - 0x38], eax
push 2
pop esi
mov dword [ebp + esi*4 - 0x3c], 0x800
inc esi
xor edi, edi
cmp esi, ebx
jle 0x45f345
push dword [ebp + edi*4 - 0x3c]
push dword [ebp + 8]
call fcn.0045f0e5
cmp eax, ebx
pop ecx
pop ecx
jne 0x45f347
inc edi
cmp edi, esi
jl 0x45f32e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.004147bc
leave
ret 4
Function at 0x45f356
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x48999c
je 0x45f412
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x45f3fa
mov esi, dword [ebx + 4]
jmp 0x45f3f4
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x45f3e4
cmp dword [ebp - 0xc], 4
jne 0x45f3e4
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x45f3dc
or dword [eax + 0x9c], ecx
jmp 0x45f3e4
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x45f3a8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x45f38b
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x45fcaa
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x46ba49
call fcn.00414900
sub esp, 0x11c
mov eax, dword [0x48a0f8]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x124]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x45fda3
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x45fd77
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.004015dc
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.0045fcaa
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00401712
test bl, bl
jne 0x45fd77
or dword [ebp - 4], 0xffffffff
jmp 0x45fce8
cmp esi, 0x103
je 0x45fd87
cmp esi, 0x3f2
jne 0x45fd97
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.004147bc
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x46058a
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x4605bf
cmp edi, dword [esi + 0xc]
jge 0x4605bf
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4605bf
cmp edi, dword [eax + 8]
jge 0x4605bf
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x4605c1
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x460748
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x46077c
jmp fcn.0042cee6
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x4607ed
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x4608e6
cmp eax, dword [edi + 0xc]
jge 0x4608e6
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x46083e
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x4608cf
cmp dword [ebp + 0xc], ebx
je 0x4608cf
jmp 0x460868
push 0x10
call fcn.00460456
cmp eax, ebx
je 0x460854
mov ecx, eax
call fcn.00460715
mov esi, eax
jmp 0x460856
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x46087f
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x46088f
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x4608a1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0042cee6
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.004148a0
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x4608e1
cmp ecx, dword [esi + 8]
jge 0x4608e1
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x4608e7
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x460e31
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov eax, 0x46be41
call fcn.00414900
mov eax, 0x1014
call fcn.004142f0
mov eax, dword [0x48a0f8]
push ebx
push edi
xor edi, edi
mov dword [ebp - 0x101c], edi
cmp dword [ecx + 0x50], edi
mov dword [ebp - 0x10], eax
je 0x460f2c
push dword [ebp + 0xc]
call fcn.00460d82
cmp eax, edi
mov dword [ebp - 0x1014], eax
jne 0x460e7a
push dword [ebp + 0x14]
jmp 0x460f5d
push esi
call fcn.00438725
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp + 0xc], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x1020]
push eax
push edi
lea eax, [ebp - 0x101c]
push eax
push edi
push dword [ebp + 0x10]
mov dword [ebp - 4], edi
push dword [ebp - 0x1014]
call esi
cmp eax, edi
mov dword [ebp - 0x1018], eax
jne 0x460ef7
lea eax, [ebp - 0x1020]
push eax
push dword [ebp - 0x1020]
lea ecx, [ebp + 0xc]
call fcn.0040143d
push eax
lea eax, [ebp - 0x101c]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp - 0x1014]
call esi
push 0xffffffffffffffff
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x1018], eax
call fcn.00401348
mov ebx, dword [ebp + 0xc]
push dword [ebp - 0x1014]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x1018], edi
mov ecx, dword [ebp + 8]
pop esi
jne 0x460f1a
lea eax, [ebp + 0xc]
push eax
call fcn.004012b2
jmp 0x460f22
push dword [ebp + 0x14]
call fcn.004015dc
lea ecx, [ebx - 0x10]
call fcn.00401712
jmp 0x460f65
cmp dword [ebp + 0x14], edi
jne 0x460f38
mov dword [ebp + 0x14], 0x471204
push dword [ecx + 0x64]
lea eax, [ebp - 0x1010]
push 0x1000
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x1010]
push eax
mov ecx, dword [ebp + 8]
call fcn.004015dc
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.004147bc
leave
ret 0x10

Function at 0x461149
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x48a0f8]
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.00415454
mov esi, eax
test esi, esi
pop ecx
je 0x4611f1
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, esi
je 0x4611e7
push edi
mov edi, SysReAllocStringLen
push ebx
push eax
push esi
mov byte [eax], 0
call fcn.004160ba
pop ecx
pop ecx
lea eax, [ebp - 0x110]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4611e5
push 0x105
lea eax, [ebp - 0x10c]
push eax
xor ebx, ebx
push ebx
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x4611bf
inc ebx
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x4611e5
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0x5c
push esi
call fcn.0041604f
test eax, eax
pop ecx
pop ecx
jne 0x461180
pop ebx
pop edi
push esi
call fcn.00414081
xor eax, eax
pop ecx
inc eax
mov ecx, dword [ebp - 4]
pop esi
call fcn.004147bc
leave
ret 4
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x40a60b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x40a61a
pop dword [ebp - 0x10]
mov eax, 0x40a61a
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x46ee09e0
sub dword [ebp - 0x20], 0xf89bc495
mov dword [ebp - 0x1c], 0x4a3cc642
add dword [ebp - 0x1c], 0xe7f68603
mov dword [ebp - 0x18], 0xd4fa47a0
add dword [ebp - 0x18], 0x7751fc8e
mov dword [ebp - 0x14], 0x34e60e19
add dword [ebp - 0x14], 0xcb19f1e7
lea eax, [ebp - 0x20]
push eax
mov eax, 0x46aa5fa3
sub eax, 0x46698f4f
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xe1ba9cd4
sub dword [ebp - 0x20], 0x6d48337e
mov dword [ebp - 0x1c], 0x6ca1a3e9
sub dword [ebp - 0x1c], 0x2b354274
mov dword [ebp - 0x18], 0x96930f96
add dword [ebp - 0x18], 0xccdc5cd6
mov dword [ebp - 0x14], 0x7eaddf3a
sub dword [ebp - 0x14], 0x7eaddf3a
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xcecd1386
add eax, 0x3173bcc6
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x39ca0
push 0
call eax
mov ecx, 0xca498e50
sub ecx, 0xca4946a3
xor edx, edx
add edx, eax
mov esi, 0x41b000
add esi, dword [ebp - 0x10]
mov ebx, 0x9bbac6f0
add ebx, 0x73320c6d
xor dword [ebp - 8], 0x6c9386ad
mov edi, dword [esi]
add dword [ebp - 8], ecx
add edi, ebx
add dword [ebp - 4], 0x57df0e99
mov dword [edx], edi
add dword [ebp - 0xc], ebx
add edx, 0xecde848a
add edx, 0x13217b7a
add esi, 4
loop 0x40a733
add eax, 0x94e689ce
add eax, 0x6b1a87b9
xor ebx, ebx
add ebx, eax
add eax, 0xe71c9d4c
sub eax, 0xe71c9d47
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x4013da
Capabilities:
Get number of processors

Disassembly:
mov ecx, 0x504fb0
jmp 0x4013ce
mov eax, 0x4c506c
call fcn.0045727c
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.004014e0
mov eax, dword [0x4fd1f0]
lea ecx, [esi + 0xa0]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ecx], eax
mov eax, dword [0x4fd1f0]
mov dword [esi + 0xb0], eax
push 1
mov dword [esi], 0x4cc7bc
or dword [esi + 0x20], 0xffffffff
or dword [esi + 0x1c], 0xffffffff
pop edi
mov dword [esi + 0x28], ebx
push 0xa
mov dword [esi + 0x24], ebx
pop eax
mov byte [ebp - 4], 2
push 0x64
mov dword [esi + 0x58], eax
mov dword [esi + 0x60], eax
pop eax
push 0x504fac
mov dword [esi + 0x2c], 2
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov dword [esi + 0x98], ebx
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], 0x3e8
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], 0xc0
mov dword [esi + 0x84], 0x6c
mov dword [esi + 0x9c], ebx
call fcn.004af86d
push 0x504fac
lea ecx, [esi + 0xb0]
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], edi
call fcn.004af86d
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40ae75
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x4c5e80
call fcn.0045727c
sub esp, 0x22c
push ebx
push esi
mov dword [ebp - 0x2c], ecx
mov esi, 0x505068
push str.DataFile_Types
mov ecx, esi
call fcn.004c253a
xor ebx, ebx
mov dword [ebp - 0x18], eax
cmp eax, ebx
jne 0x40aeab
xor eax, eax
jmp 0x40aff3
mov eax, dword [0x4fd1f0]
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x38]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
push ebx
push ebx
lea eax, [ebp - 0x24]
push ebx
push eax
lea eax, [ebp - 0x238]
mov byte [ebp - 4], 2
push eax
push ebx
push dword [ebp - 0x18]
mov dword [ebp - 0x24], 0x100
mov dword [ebp - 0x20], ebx
call edi
cmp eax, 0x103
je 0x40afc3
lea eax, [ebp - 0x238]
push eax
push str.DataFile_Types
lea eax, [ebp - 0x10]
push 0x4ebf40
push eax
call fcn.004ad007
add esp, 0x10
lea eax, [ebp - 0x28]
mov ecx, esi
push ebx
push str.Name
push dword [ebp - 0x10]
push eax
call fcn.004c25ec
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.004af81d
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.004af6d6
push ebx
push str.Extension
push dword [ebp - 0x10]
lea eax, [ebp - 0x30]
mov ecx, esi
push eax
call fcn.004c25ec
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.004af81d
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.004af6d6
push 0xffffffffffffffff
push str.Icon
push dword [ebp - 0x10]
mov ecx, esi
call fcn.004c2580
mov ecx, dword [ebp - 0x14]
cmp dword [ecx - 8], ebx
je 0x40af9c
mov edx, dword [ebp - 0x1c]
cmp dword [edx - 8], ebx
je 0x40af9c
cmp eax, 0xffffffff
je 0x40af9c
push eax
push edx
push ecx
mov ecx, dword [ebp - 0x2c]
call fcn.0040b0e0
lea eax, [ebp - 0x38]
inc dword [ebp - 0x20]
push eax
push ebx
push ebx
lea eax, [ebp - 0x24]
push ebx
push eax
lea eax, [ebp - 0x238]
mov dword [ebp - 0x24], 0x100
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x18]
jmp 0x40aee7
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004af6d6
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.004af6d6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004af6d6
push 1
pop eax
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40c12f
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push ebx
push esi
lea eax, [ebp - 4]
push edi
xor ebx, ebx
push eax
mov edi, 0x4ced00
push ebx
push ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov esi, 0x2b4
lea eax, [ebp - 0x2bc]
push esi
push ebx
push eax
call fcn.004572a0
lea eax, [ebp - 8]
add esp, 0xc
neg eax
sbb eax, eax
lea ecx, [ebp - 4]
and eax, ecx
xor ecx, ecx
cmp dword [ebp + 8], ebx
mov eax, dword [eax]
sete cl
or cx, 0x4008
push ecx
lea ecx, [ebp - 0x2bc]
push esi
push ecx
push ebx
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea ecx, [ebp - 8]
mov esi, eax
neg ecx
sbb ecx, ecx
lea eax, [ebp - 4]
and ecx, eax
mov dword [ebp - 8], edi
call fcn.0040c4bd
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40cd40
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
push esi
mov esi, 0x2b4
push edi
push esi
lea eax, [ebp - 0x2b4]
push 0
mov edi, ecx
push eax
call fcn.004572a0
mov eax, dword [ebp + 8]
add esp, 0xc
or ax, 0x4008
push eax
lea eax, [ebp - 0x2b4]
push esi
push eax
push 0
push dword [edi + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [ebp - 0x2b0]
pop edi
pop esi
leave
ret 4

Function at 0x40e451
Capabilities:
Check os version

Disassembly:
mov eax, 0x4c6363
call fcn.0045727c
sub esp, 0x118
push ebx
push esi
push edi
xor ebx, ebx
push dword [ebp + 0x1c]
mov esi, ecx
mov dword [ebp - 0x10], esi
push ebx
call fcn.004b4499
mov eax, dword [0x4fd1f0]
mov dword [ebp - 4], ebx
mov dword [esi + 0x64], eax
cmp dword [ebp + 0x20], ebx
mov byte [ebp - 4], 1
mov dword [esi], 0x4cf2d0
jne 0x40e4d7
mov edi, 0x114
lea eax, [ebp - 0x124]
push edi
push ebx
push eax
call fcn.004572a0
add esp, 0xc
lea eax, [ebp - 0x124]
mov dword [ebp - 0x124], edi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 2
jne 0x40e4d0
cmp dword [ebp - 0x120], 5
mov dword [ebp + 0x20], 0x58
jae 0x40e4d7
mov dword [ebp + 0x20], 0x4c
push dword [ebp + 0x20]
call fcn.00457a6d
cmp eax, ebx
pop ecx
mov dword [esi + 0x5c], eax
jne 0x40e4ec
call fcn.004ad6e8
push dword [ebp + 0x20]
mov ecx, esi
push ebx
call fcn.0040e6b1
push eax
call fcn.004572a0
push 0x200002
call fcn.004afcaa
mov dword [esi + 0xe8], eax
mov word [eax], bx
mov eax, dword [ebp + 8]
add esp, 0x10
mov dword [esi + 0x60], eax
lea edi, [esi + 0x68]
neg eax
sbb eax, eax
mov ecx, esi
add eax, 0x7005
mov word [edi], bx
mov dword [esi + 0xec], ebx
mov dword [esi + 0x3c], eax
call fcn.0040e6b1
mov ecx, dword [ebp + 0x20]
mov dword [eax], ecx
mov ecx, esi
call fcn.0040e6b1
mov ecx, dword [esi + 0xe8]
mov dword [eax + 0x1c], ecx
mov ecx, esi
call fcn.0040e6b1
mov ecx, esi
mov dword [eax + 0x20], 0x100000
call fcn.0040e6b1
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x3c], ecx
mov ecx, esi
call fcn.0040e6b1
mov ecx, esi
mov dword [eax + 0x24], edi
call fcn.0040e6b1
mov ecx, esi
mov dword [eax + 0x28], 0x40
call fcn.0040e6b1
mov ecx, dword [ebp + 0x14]
add eax, 0x34
or ecx, 0x880020
or dword [eax], ecx
test byte [ebp + 0x14], 0x40
je 0x40e5a9
mov ecx, esi
call fcn.0040e6b1
add eax, 0x34
and byte [eax + 2], 0x7f
call fcn.004c239b
mov edi, dword [eax + 0xc]
mov ecx, esi
call fcn.0040e6b1
mov ecx, esi
mov dword [eax + 8], edi
call fcn.0040e6b1
cmp dword [ebp + 0x10], ebx
mov dword [eax + 0x44], 0x40e2da
je 0x40e5e2
push 0x100000
push dword [ebp + 0x10]
push dword [esi + 0xe8]
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
cmp dword [ebp + 0x18], ebx
je 0x40e621
push dword [ebp + 0x18]
lea edi, [esi + 0x64]
mov ecx, edi
call fcn.004af86d
push ebx
mov ecx, edi
call fcn.004afb1b
push 0x7c
push eax
call fcn.00457a44
pop ecx
cmp eax, ebx
pop ecx
je 0x40e614
mov word [eax], bx
push 0x7c
add eax, 2
jmp 0x40e5fe
mov edi, dword [esi + 0x64]
mov ecx, esi
call fcn.0040e6b1
mov dword [eax + 0xc], edi
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x1c