joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fe99
Capabilities:
Get disk size

Disassembly:
push ebp
lea ebp, [esp - 0x1c0]
sub esp, 0x240
mov eax, dword [0x50cb30]
xor eax, ebp
mov dword [ebp + 0x1bc], eax
push ebx
push esi
mov esi, dword [ebp + 0x1c8]
push edi
xor ebx, ebx
xor eax, eax
mov word [ebp + 0x1b4], bx
lea edi, [ebp + 0x1b6]
stosd dword es:[edi], eax
push 0x206
stosw word es:[edi], ax
lea eax, [ebp - 0x52]
push ebx
push eax
mov dword [ebp - 0x58], ecx
mov word [ebp - 0x54], bx
call fcn.004203a0
push esi
call fcn.0042054a
add esp, 0x10
cmp eax, 3
jl 0x40ff07
push 3
lea eax, [ebp + 0x1b4]
push esi
push eax
call fcn.00421782
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x1b4]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x68]
mov esi, dword [ebp - 0x58]
shrd ecx, eax, 0x14
shr eax, 0x14
mov dword [ebp - 0x5c], eax
and dword [ebp - 0x5c], 0x80000000
and eax, 0x7fffffff
cmp dword [esi + 0x660], ebx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x60], ebx
fild qword [ebp - 0x70]
fild qword [ebp - 0x60]
fchs
faddp st(1)
fstp dword [ebp - 0x5c]
je 0x40ffb4
fld dword [ebp - 0x5c]
call fcn.00421840
cmp eax, 0x400
jle 0x40ff93
fld dword [ebp - 0x5c]
push ecx
fmul qword [0x4c7938]
push ecx
lea eax, [ebp - 0x54]
fstp dword [ebp - 0x58]
fld dword [ebp - 0x58]
fstp qword [esp]
push str._.2fGB
push eax
call fcn.00421321
add esp, 0x10
jmp 0x40ffa5
push eax
lea eax, [ebp - 0x54]
push str._dMB
push eax
call fcn.00421321
add esp, 0xc
mov ecx, dword [esi + 0x660]
mov eax, dword [ecx]
lea edx, [ebp - 0x54]
push edx
call dword [eax + 0x2c]
mov ecx, dword [ebp + 0x1bc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420385
add ebp, 0x1c0
leave
ret 4

Function at 0x4117d5
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 8

Function at 0x41182b
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
test esi, esi
mov ebx, ecx
jne 0x411841
push 0x80004005
call fcn.004115d9
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x411844
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
ret 8
Function at 0x411dab
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x50cb30]
xor eax, ebp
mov dword [ebp + 0x194], eax
mov eax, dword [ebp + 0x1a0]
push ebx
push esi
push edi
push 0x2001f
mov ebx, ecx
push eax
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], esi
call fcn.004117a0
mov edi, eax
cmp edi, esi
je 0x411e13
lea ecx, [ebp - 0x70]
call fcn.0041173b
mov eax, edi
mov ecx, dword [ebp + 0x194]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420385
add ebp, 0x198
leave
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x411e2b
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x70]
call fcn.00411dab
cmp eax, esi
jne 0x411e5e
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x100
call edi
test eax, eax
je 0x411e1b
lea ecx, [ebp - 0x70]
call fcn.0041173b
push dword [ebp - 0x78]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.0041173b
mov eax, esi
jmp 0x411df9
Function at 0x4142e6
Capabilities:
Get disk size

Disassembly:
push ebp
lea ebp, [esp - 0x1c0]
sub esp, 0x240
mov eax, dword [0x50cb30]
xor eax, ebp
mov dword [ebp + 0x1bc], eax
push ebx
push esi
mov esi, dword [ebp + 0x1c8]
push edi
xor ebx, ebx
xor eax, eax
mov word [ebp + 0x1b4], bx
lea edi, [ebp + 0x1b6]
stosd dword es:[edi], eax
push 0x206
stosw word es:[edi], ax
lea eax, [ebp - 0x52]
push ebx
push eax
mov dword [ebp - 0x58], ecx
mov word [ebp - 0x54], bx
call fcn.004203a0
push esi
call fcn.0042054a
add esp, 0x10
cmp eax, 3
jl 0x414354
push 3
lea eax, [ebp + 0x1b4]
push esi
push eax
call fcn.00421782
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x1b4]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x68]
mov esi, dword [ebp - 0x58]
shrd ecx, eax, 0x14
shr eax, 0x14
mov dword [ebp - 0x5c], eax
and dword [ebp - 0x5c], 0x80000000
and eax, 0x7fffffff
cmp dword [esi + 0x6a4], ebx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x60], ebx
fild qword [ebp - 0x70]
fild qword [ebp - 0x60]
fchs
faddp st(1)
fstp dword [ebp - 0x5c]
je 0x414401
fld dword [ebp - 0x5c]
call fcn.00421840
cmp eax, 0x400
jle 0x4143e0
fld dword [ebp - 0x5c]
push ecx
fmul qword [0x4c7938]
push ecx
lea eax, [ebp - 0x54]
fstp dword [ebp - 0x58]
fld dword [ebp - 0x58]
fstp qword [esp]
push str._.2fGB
push eax
call fcn.00421321
add esp, 0x10
jmp 0x4143f2
push eax
lea eax, [ebp - 0x54]
push str._dMB
push eax
call fcn.00421321
add esp, 0xc
mov ecx, dword [esi + 0x6a4]
mov eax, dword [ecx]
lea edx, [ebp - 0x54]
push edx
call dword [eax + 0x2c]
mov ecx, dword [ebp + 0x1bc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420385
add ebp, 0x1c0
leave
ret 4
Function at 0x414df5
Capabilities:
Check if file exists

Disassembly:
push 0xd0
mov eax, 0x4c2096
call fcn.00420f05
mov esi, ecx
lea eax, [esi + 0x69c]
xor edi, edi
cmp dword [eax], edi
je 0x414f9b
mov ecx, dword [eax]
mov eax, dword [ecx]
lea edx, [ebp - 0xdc]
xor ebx, ebx
push edx
inc ebx
call dword [eax + 0x28]
mov ecx, eax
mov dword [ebp - 4], edi
call dword [0x4e9d4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00401c20
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 2
call dword [0x4e9cec]
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x414e57
lea eax, [ebp - 0x28]
push eax
call fcn.0042054a
cmp eax, 3
pop ecx
jle 0x414e9a
push 3
push edi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00403a80
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x414e7e
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x414e8b
xor ebx, ebx
push edi
push 1
lea ecx, [ebp - 0x48]
call fcn.00401e20
cmp ebx, edi
jne 0x414eba
lea eax, [esi + 0x66c]
cmp dword [eax], edi
je 0x414f90
mov eax, dword [eax]
mov edx, dword [eax]
push edi
mov ecx, eax
call dword [edx + 0xd8]
jmp 0x414f90
mov ecx, dword [esi + 0x674]
cmp ecx, edi
je 0x414f1c
call dword [0x4e9d04]
test al, al
lea eax, [esi + 0x66c]
je 0x414ef4
cmp dword [eax], edi
je 0x414ee6
mov eax, dword [eax]
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx + 0xd8]
lea eax, [esi + 0x670]
cmp dword [eax], edi
je 0x414f1c
push 1
jmp 0x414f10
cmp dword [eax], edi
je 0x414f05
mov eax, dword [eax]
mov edx, dword [eax]
push edi
mov ecx, eax
call dword [edx + 0xd8]
lea eax, [esi + 0x670]
cmp dword [eax], edi
je 0x414f1c
push edi
mov eax, dword [eax]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xd8]
lea ebx, [esi + 0x50c]
push ebx
push dword [ebx + 4]
lea ecx, [ebp - 0x50]
call fcn.004139bc
push ebx
push dword [ebx + 8]
lea ecx, [ebp - 0x58]
call fcn.004139bc
jmp 0x414f6c
lea ecx, [ebp - 0x50]
call fcn.0040c0ae
cmp dword [eax], edi
je 0x414f64
lea ecx, [ebp - 0x50]
call fcn.0040c0ae
cmp dword [ebp - 0x14], 8
mov ecx, dword [eax]
mov eax, dword [ebp - 0x28]
jae 0x414f5e
lea eax, [ebp - 0x28]
mov edx, dword [ecx]
push eax
call dword [edx + 0x10]
lea ecx, [ebp - 0x50]
call fcn.00413951
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x50]
call fcn.0041057d
test al, al
je 0x414f3c
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x414f88
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
call fcn.004142e6
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401e20
call fcn.00420f88
ret
Function at 0x4159cb
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [esp + 0x14]
call fcn.0042054a
mov edi, eax
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041f3a0
push dword [esp + 0x1c]
mov esi, eax
push esi
call fcn.0042052e
add esp, 0x10
xor ebp, ebp
test edi, edi
mov bl, 1
jl 0x415a3a
cmp word [esi + ebp*2], 0x5c
jne 0x415a31
and word [esi + ebp*2], 0
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x415a2b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x415a38
mov word [esi + ebp*2], 0x5c
inc ebp
cmp ebp, edi
jle 0x415a08
jmp 0x415a3a
xor bl, bl
push esi
call fcn.004213cd
pop ecx
pop edi
pop esi
pop ebp
movzx eax, bl
pop ebx
ret

Function at 0x415c42
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x7a8]
sub esp, 0x828
mov eax, dword [0x50cb30]
xor eax, ebp
mov dword [ebp + 0x7a4], eax
push esi
push edi
mov edi, dword [ebp + 0x7b0]
push 0x44
xor esi, esi
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.004203a0
push 0x10
lea eax, [ebp - 0x3c]
push esi
push eax
mov dword [ebp - 0x80], 0x44
call fcn.004203a0
push edi
lea eax, [ebp - 0x2c]
push 0x4c7580
push eax
call fcn.00421321
add esp, 0x24
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
push 1
push esi
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x415cc6
push dword [ebp - 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x38]
call esi
mov ecx, dword [ebp + 0x7a4]
pop edi
xor ecx, ebp
pop esi
call fcn.00420385
add ebp, 0x7a8
leave
ret
Function at 0x415e83
Capabilities:
Check if file exists
Copy file
Delete file
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x5a8]
sub esp, 0x628
mov eax, dword [0x50cb30]
xor eax, ebp
mov dword [ebp + 0x5a4], eax
mov eax, dword [ebp + 0x5b4]
push ebx
push esi
mov esi, dword [ebp + 0x5b0]
push edi
mov ebx, 0x206
xor edi, edi
push ebx
mov dword [ebp - 0x78], eax
lea eax, [ebp + 0x196]
push edi
push eax
mov dword [ebp - 0x80], esi
mov word [ebp + 0x194], di
call fcn.004203a0
push ebx
lea eax, [ebp - 0x72]
push edi
push eax
mov word [ebp - 0x74], di
call fcn.004203a0
lea eax, [ebp + 0x194]
push esi
push eax
call fcn.0042052e
push dword [ebp - 0x78]
lea eax, [ebp - 0x74]
push eax
call fcn.0042052e
lea eax, [ebp + 0x194]
push eax
call fcn.00422524
lea eax, [ebp - 0x74]
push eax
call fcn.00422524
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x194]
push eax
call fcn.00421565
add esp, 0x38
test eax, eax
je 0x415feb
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [ebp - 0x7c], edi
push ebx
lea eax, [ebp + 0x39e]
push edi
push eax
mov word [ebp + 0x39c], di
call fcn.004203a0
add esp, 0xc
cmp dword [ebp - 0x7c], edi
lea eax, [ebp + 0x39c]
jne 0x415f66
push dword [ebp - 0x78]
push str._s.bak
push eax
call fcn.00421321
add esp, 0xc
jmp 0x415f7a
push dword [ebp - 0x7c]
push dword [ebp - 0x78]
push str._s.bak_d
push eax
call fcn.00421321
add esp, 0x10
lea eax, [ebp + 0x39c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x415f98
lea eax, [ebp + 0x39c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp + 0x39c]
push eax
push dword [ebp - 0x78]
call fcn.004227b0
pop ecx
pop ecx
lea eax, [ebp + 0x39c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
push dword [ebp - 0x78]
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 5
test eax, eax
push edi
lea eax, [ebp + 0x39c]
push eax
jne 0x415fe1
call esi
cmp dword [ebp - 0x7c], 0xa
jge 0x415feb
inc dword [ebp - 0x7c]
jmp 0x415f30
call esi
push 5
push edi
push dword [ebp - 0x80]
call esi
mov ecx, dword [ebp + 0x5a4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420385
add ebp, 0x5a8
leave
ret
Function at 0x416003
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x50cb30]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
push str..del
push edi
call fcn.00421286
test eax, eax
pop ecx
pop ecx
je 0x41603b
push 5
push 0
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x4160d2
push esi
xor esi, esi
and word [ebp - 0x20c], 0
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
call fcn.004203a0
add esp, 0xc
test esi, esi
lea eax, [ebp - 0x20c]
jne 0x416077
push edi
push str._s.del
push eax
call fcn.00421321
add esp, 0xc
jmp 0x416087
push esi
push edi
push str._s.del_d
push eax
call fcn.00421321
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4160b1
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4160b1
cmp esi, 0xa
jge 0x4160d1
inc esi
jmp 0x41603e
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.004227b0
pop ecx
pop ecx
push 5
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00420385
leave
ret

Function at 0x4160df
Capabilities:
Check if file exists
Delete file
Get common file path
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x5a4]
sub esp, 0x624
mov eax, dword [0x50cb30]
xor eax, ebp
mov dword [ebp + 0x5a0], eax
push esi
mov esi, dword [ebp + 0x5ac]
push esi
mov dword [ebp - 0x80], esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x416223
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call ebx
test eax, eax
jne 0x416222
push edi
mov esi, 0x206
xor edi, edi
push esi
lea eax, [ebp - 0x76]
push edi
push eax
mov word [ebp - 0x78], di
call fcn.004203a0
push esi
lea eax, [ebp + 0x192]
push edi
push eax
mov word [ebp + 0x190], di
call fcn.004203a0
add esp, 0x18
lea eax, [ebp + 0x190]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x80]
call fcn.00415cdd
pop ecx
pop ecx
mov dword [ebp - 0x7c], edi
push esi
lea eax, [ebp + 0x39a]
push edi
push eax
mov word [ebp + 0x398], di
call fcn.004203a0
add esp, 0xc
cmp dword [ebp - 0x7c], edi
lea eax, [ebp - 0x78]
jne 0x4161b5
push eax
lea eax, [ebp + 0x190]
push eax
lea eax, [ebp + 0x398]
push str._s_s.del
push eax
call fcn.00421321
add esp, 0x10
jmp 0x4161d4
push dword [ebp - 0x7c]
push eax
lea eax, [ebp + 0x190]
push eax
lea eax, [ebp + 0x398]
push str._s_s.del_d
push eax
call fcn.00421321
add esp, 0x14
lea eax, [ebp + 0x398]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x416200
lea eax, [ebp + 0x398]
push eax
call ebx
cmp eax, edi
jne 0x416200
cmp dword [ebp - 0x7c], 0xa
jge 0x416221
inc dword [ebp - 0x7c]
jmp 0x416177
lea eax, [ebp + 0x398]
push eax
push dword [ebp - 0x80]
call fcn.004227b0
pop ecx
pop ecx
push 5
push edi
lea eax, [ebp + 0x398]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop edi
pop ebx
mov ecx, dword [ebp + 0x5a0]
xor ecx, ebp
pop esi
call fcn.00420385
add ebp, 0x5a4
leave
ret
Function at 0x41d62d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x50cb30]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push edi
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
mov edi, ecx
call fcn.004203a0
add esp, 0xc
push 0
push 0xb
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41d68b
lea eax, [ebp - 0x20c]
push eax
push str.ItemTopStartMenu
mov ecx, edi
call fcn.0041d52f
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00420385
leave
ret

Function at 0x41d698
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x50cb30]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push edi
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
mov edi, ecx
call fcn.004203a0
add esp, 0xc
push 0
push 2
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
push eax
push str.ItemSecondStartMenu
mov ecx, edi
call fcn.0041d52f
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00420385
leave
ret

Function at 0x41d6ff
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x50cb30]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push edi
push 0x206
lea eax, [ebp - 0x20a]
push 0
push eax
mov edi, ecx
call fcn.004203a0
add esp, 0xc
push 0
push 0x1a
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41d770
lea eax, [ebp - 0x20c]
push str.MicrosoftInternet_ExplorerQuick_Launch
push eax
call fcn.00420504
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
push str.ItemQuickLauch
mov ecx, edi
call fcn.0041d52f
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00420385
leave
ret
Function at 0x41decf
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x50cb30]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
push 0x206
lea eax, [ebp - 0x20a]
push edi
push eax
mov esi, ecx
mov word [ebp - 0x20c], di
call fcn.004203a0
add esp, 0xc
call fcn.00416360
test eax, eax
push edi
lea eax, [ebp - 0x20c]
je 0x41df18
push 0x1a
jmp 0x41df1a
push 0x26
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
lea edi, [esi + 0x3c]
push eax
mov ecx, edi
call fcn.00401df0
mov esi, 0x4e9b70
push esi
mov ecx, edi
call fcn.00403ac0
push str.hao123JuziBrowser
mov ecx, edi
call fcn.00403ac0
push esi
mov ecx, edi
call fcn.00403ac0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00420385
leave
ret
Function at 0x41e514
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x50cb30]
xor eax, ebp
mov dword [ebp + 0x190], eax
push esi
xor esi, esi
push 0x206
lea eax, [ebp - 0x76]
push esi
push eax
mov word [ebp - 0x78], si
call fcn.004203a0
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
push esi
push esi
push 0x25
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x41e5cb
push 0x4c6ce0
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x41e5cb
push ebx
push esi
lea eax, [ebp - 0x78]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
cmp ebx, esi
jbe 0x41e5ca
push edi
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
cmp edi, esi
je 0x41e5c9
push edi
push ebx
push esi
lea eax, [ebp - 0x78]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x41e5c2
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x4e9b70
push edi
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x7c], esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x41e5c2
mov eax, dword [ebp - 0x7c]
mov esi, dword [eax + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop ebx
mov ecx, dword [ebp + 0x190]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00420385
add ebp, 0x194
leave
ret

Function at 0x41e5e3
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
lea ebp, [esp - 0x240]
sub esp, 0x2c0
mov eax, dword [0x50cb30]
xor eax, ebp
mov dword [ebp + 0x23c], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push dword [ebp + 0x248]
mov byte [ebp - 0x79], bl
push ebx
mov dword [ebp - 0x80], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
jne 0x41e66e
push esi
push 0x2b0
lea eax, [ebp - 0x74]
push ebx
push eax
mov dword [ebp - 0x78], ebx
call fcn.004203a0
add esp, 0xc
mov esi, 0x208
push esi
push 0x2b4
lea eax, [ebp - 0x78]
push eax
push ebx
push dword [ebp - 0x80]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
setne byte [ebp - 0x79]
cmp byte [ebp - 0x79], bl
je 0x41e664
push esi
lea eax, [ebp - 0x6c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push dword [ebp - 0x80]
call dword [sym.imp.SHELL32.dll_ILFree]
pop esi
mov ecx, dword [ebp + 0x23c]
mov al, byte [ebp - 0x79]
xor ecx, ebp
pop ebx
call fcn.00420385
add ebp, 0x240
leave
ret 4
Function at 0x420385
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x50cb30]
jne 0x42038f
repz ret
jmp fcn.00429e57

Function at 0x4338a0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00427a13
xor ebx, ebx
cmp dword [0x512ccc], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x433975
push 0x4c95a8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, ebx
jne 0x4338e0
xor eax, eax
jmp 0x433a39
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4cb958
push edi
call esi
cmp eax, ebx
je 0x4338d9
push eax
call fcn.004279b0
mov dword [esp], 0x4cb948
push edi
mov dword [0x512ccc], eax
call esi
push eax
call fcn.004279b0
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x512cd0], eax
call esi
push eax
call fcn.004279b0
mov dword [0x512cd4], eax
lea eax, [ebp - 8]
push eax
call fcn.0042754c
test eax, eax
pop ecx
pop ecx
je 0x433943
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004205d2
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x433975
push str.GetUserObjectInformationW
push edi
call esi
push eax
call fcn.004279b0
cmp eax, ebx
pop ecx
mov dword [0x512cdc], eax
je 0x433975
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004279b0
pop ecx
mov dword [0x512cd8], eax
mov eax, dword [0x512cd8]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x4339ee
cmp dword [0x512cdc], esi
je 0x4339ee
push eax
call fcn.00427a1c
pop ecx
call eax
cmp eax, ebx
je 0x4339bb
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x512cdc]
call fcn.00427a1c
pop ecx
call eax
test eax, eax
je 0x4339bb
test byte [ebp - 0x18], 1
jne 0x4339ee
lea eax, [ebp - 0xc]
push eax
call fcn.00427583
test eax, eax
pop ecx
je 0x4339d6
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004205d2
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x4339e5
or dword [ebp + 0x10], 0x200000
jmp 0x433a1f
or dword [ebp + 0x10], 0x40000
jmp 0x433a1f
mov eax, dword [0x512cd0]
cmp eax, esi
je 0x433a1f
push eax
call fcn.00427a1c
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x433a1f
mov eax, dword [0x512cd4]
cmp eax, esi
je 0x433a1f
push dword [ebp - 4]
push eax
call fcn.00427a1c
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x512ccc]
call fcn.00427a1c
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret