joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4087f0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x5c], ecx
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x6df8098f
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x127d5483
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d7a
nop
sub eax, 0x403d20
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x402636
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x4a946c]
xor eax, ebp
mov dword [ebp + 0x94], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0x40]
push edi
xor edi, edi
mov dword [ebp - 0x7c], edi
mov dword [esi + 4], 1
cmp dword [eax - 0xc], edi
jne 0x40267b
push 0x104
lea eax, [ebp - 0x70]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x40268d
push eax
lea eax, [ebp - 0x70]
push 0x104
push eax
call fcn.004571f6
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x70]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
cmp eax, edi
mov dword [esi + 0x3c], eax
je 0x4027ef
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [ebp - 0x74], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
push dword [esi + 0x3c]
mov dword [esi], eax
push dword [ebp - 0x7c]
lea eax, [ebp - 0x70]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4027dd
push ebx
mov ecx, esi
call fcn.004021a5
lea ebx, [esi + 0x44]
mov eax, dword [ebx]
cmp dword [eax - 0xc], edi
je 0x4026ec
mov eax, dword [esi + 0x48]
cmp dword [eax - 0xc], edi
jne 0x40272c
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push str.VarFileInfoTranslation
push dword [esi]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40272c
mov eax, dword [ebp - 0x78]
movzx eax, word [eax]
push eax
mov edi, str._4.4X
push edi
push ebx
call fcn.004023ec
mov eax, dword [ebp - 0x78]
movzx eax, word [eax + 2]
push eax
lea eax, [esi + 0x48]
push edi
push eax
call fcn.004023ec
add esp, 0x18
lea eax, [esi + 0x4c]
push eax
push 0x477fbc
mov ecx, esi
call fcn.004024ea
lea eax, [esi + 0x50]
push eax
push 0x477fac
mov ecx, esi
call fcn.004024ea
lea eax, [esi + 0x54]
push eax
push 0x477fa0
mov ecx, esi
call fcn.004024ea
lea eax, [esi + 0x58]
push eax
push 0x477f90
mov ecx, esi
call fcn.004024ea
lea eax, [esi + 0x5c]
push eax
push 0x477f80
mov ecx, esi
call fcn.004024ea
lea eax, [esi + 0x60]
push eax
push 0x477f6c
mov ecx, esi
call fcn.004024ea
lea eax, [esi + 0x64]
push eax
push 0x477f60
mov ecx, esi
call fcn.004024ea
lea eax, [esi + 0x68]
push eax
push 0x477f50
mov ecx, esi
call fcn.004024ea
lea eax, [esi + 0x6c]
push eax
push str.Comments
mov ecx, esi
call fcn.004024ea
lea eax, [esi + 0x70]
push eax
push str.SpecialBuild
mov ecx, esi
call fcn.004024ea
lea eax, [esi + 0x74]
push eax
push str.PrivateBuild
mov ecx, esi
call fcn.004024ea
pop ebx
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp + 0x94]
pop edi
xor ecx, ebp
pop esi
call fcn.004550ad
add ebp, 0x98
leave
ret
Function at 0x424239
Capabilities:
Persist via run registry key

Disassembly:
push 0x20
mov eax, 0x4716f2
call fcn.004550bc
mov ebx, ecx
lea ecx, [ebp - 0x2c]
call fcn.00435c47
xor edi, edi
push SysReAllocStringLen
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], edi
call fcn.00435a09
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareMacromediaFlashPlayer
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
cmp eax, edi
je 0x424286
lea ecx, [ebp - 0x2c]
call fcn.00435a64
call fcn.00442144
push eax
lea ecx, [ebp - 0x10]
call fcn.0040132d
push 0xffffffffffffffff
lea esi, [ebx + 0x1450]
push edi
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0044a148
mov edi, 0x477979
lea ecx, [ebx + 0x144c]
push edi
call fcn.00401759
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
test eax, eax
je 0x4243f6
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push edi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.AppData
mov byte [ebp - 4], 2
call fcn.00401c93
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00436249
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.0040170c
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.004010af
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x4243f6
push str.Adobe
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0040177e
add esp, 0xc
lea edi, [ebx + 0x144c]
push eax
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.0040170c
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.004010af
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, esi
call fcn.0044a503
mov edi, str.FLASHPLAYER
lea ecx, [ebx + 0x147c]
push edi
call fcn.00401759
push 3
mov ecx, ebx
call fcn.0041f334
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.0044a148
push str.Macromedia
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0040177e
add esp, 0xc
push eax
lea ecx, [ebx + 0x144c]
mov byte [ebp - 4], 5
call fcn.0040170c
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.004010af
mov eax, dword [esi + 8]
lea ecx, [ebx + 0x144c]
push ecx
push eax
mov ecx, esi
call fcn.0044a503
push edi
lea ecx, [ebx + 0x147c]
call fcn.00401759
push 3
mov ecx, ebx
call fcn.0041f334
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004010af
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00435c67
call fcn.0045515b
ret
Function at 0x42c10d
Capabilities:
Persist via run registry key

Disassembly:
push 0x20
mov eax, 0x47254c
call fcn.004550bc
mov esi, ecx
lea ecx, [ebp - 0x2c]
call fcn.00435c47
and dword [ebp - 4], 0
push SysReAllocStringLen
lea ecx, [ebp - 0x2c]
call fcn.00435a09
call fcn.00442144
push eax
lea ecx, [ebp - 0x10]
call fcn.0040132d
push 0xffffffffffffffff
lea ebx, [esi + 0x1450]
push 0
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.0044a148
mov edi, 0x477979
lea ecx, [esi + 0x144c]
push edi
call fcn.00401759
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareMicrosoftWindowsCurrentVersionexplorerShell_Folders
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
test eax, eax
je 0x42c23a
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push edi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.Common_AppData
mov byte [ebp - 4], 2
call fcn.00401c93
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00436249
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.0040170c
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.004010af
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x42c23a
push str.QuickTime
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0040177e
add esp, 0xc
lea edi, [esi + 0x144c]
push eax
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.0040170c
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.004010af
mov eax, dword [ebx + 8]
push edi
push eax
mov ecx, ebx
call fcn.0044a503
lea ecx, [esi + 0x147c]
push str.QuickTime_6.x
call fcn.00401759
push 3
mov ecx, esi
call fcn.0041f334
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004010af
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00435c67
call fcn.0045515b
ret
Function at 0x42f930
Capabilities:
Persist via run registry key

Disassembly:
push 0x24
mov eax, 0x472b23
call fcn.004550bc
mov esi, ecx
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x30]
call fcn.00435c47
xor edi, edi
push SysReAllocStringLen
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], edi
call fcn.00435a09
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareMicrosoftOffice11.0Clip_OrganizerSearchLast_Query
call fcn.00401c93
lea ecx, [ebp - 0x30]
call fcn.00436002
cmp eax, edi
je 0x42f990
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.LastSearchText
call fcn.00401c93
lea ecx, [ebp - 0x30]
call fcn.00435c7b
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareMicrosoftOffice11.0CommonOpen_FindAdd_Clips_to_OrganizerSettings
call fcn.00401c93
lea ecx, [ebp - 0x30]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareMicrosoftOffice11.0CommonOpen_FindClip_OrganizerSettingsAdd_Directory_to_Collection_PropertiesFile_Name_MRU
call fcn.00401c93
lea ecx, [ebp - 0x30]
call fcn.00435faa
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareMicrosoftOffice11.0Clip_Organizer
call fcn.00401c93
lea ecx, [ebp - 0x30]
call fcn.00436002
cmp eax, edi
je 0x42f9f5
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.MRUKeywords
call fcn.00401c93
lea ecx, [ebp - 0x30]
call fcn.00435c7b
call fcn.00442144
push eax
lea ecx, [ebp - 0x10]
call fcn.0040132d
push 0xffffffffffffffff
lea ebx, [esi + 0x1450]
push edi
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.0044a148
add esi, 0x144c
mov edi, 0x477979
push edi
mov ecx, esi
call fcn.00401759
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00401c93
lea ecx, [ebp - 0x30]
call fcn.00436002
test eax, eax
je 0x42fadc
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push edi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.AppData
mov byte [ebp - 4], 2
call fcn.00401c93
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.00436249
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.0040170c
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.004010af
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
je 0x42fadc
push str.MicrosoftClip_Organizermstore10.mgc
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.0040177e
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.0040170c
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.004010af
mov eax, dword [ebx + 8]
lea ecx, [ebp - 0x10]
push ecx
push eax
mov ecx, ebx
call fcn.0044a503
mov esi, dword [ebp - 0x18]
cmp dword [esi + 0x1458], 0
je 0x42fb01
lea ecx, [esi + 0x147c]
push 0x48cdb0
call fcn.00401759
push 0
mov ecx, esi
call fcn.0041f334
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004010af
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00435c67
call fcn.0045515b
ret
Function at 0x42ffc8
Capabilities:
Persist via run registry key

Disassembly:
push 0x20
mov eax, 0x472bec
call fcn.004550bc
mov ebx, ecx
lea ecx, [ebp - 0x2c]
call fcn.00435c47
and dword [ebp - 4], 0
call fcn.00442144
push eax
lea ecx, [ebp - 0x10]
call fcn.0040132d
push 0xffffffffffffffff
lea ecx, [ebx + 0x1450]
push 0
mov byte [ebp - 4], 1
call fcn.0044a148
lea esi, [ebx + 0x144c]
mov edi, 0x477979
push edi
mov ecx, esi
call fcn.00401759
push SysReAllocStringLen
lea ecx, [ebp - 0x2c]
call fcn.00435a09
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareMicrosoftFrontPageEditorInsert_HyperlinkRecently_Used_URLs
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareMicrosoftFrontPageExplorerFrontPage_ExplorerRecent_File_List
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareMicrosoftFrontPageExplorerFrontPage_ExplorerRecent_Page_List
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareMicrosoftFrontPageExplorerFrontPage_ExplorerRecent_Web_List
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareMicrosoftFrontPageExplorerFrontPage_ExplorerRecently_Created_Servers
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00435faa
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
test eax, eax
je 0x430151
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push edi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.AppData
mov byte [ebp - 4], 2
call fcn.00401c93
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00436249
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.0040170c
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.004010af
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
je 0x430151
push str.MicrosoftWeb_Server_ExtensionsCache
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.0040177e
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.0040170c
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.004010af
lea ecx, [ebx + 0x1450]
mov eax, dword [ecx + 8]
lea edx, [ebp - 0x10]
push edx
push eax
call fcn.0044a503
cmp dword [ebx + 0x1458], 0
je 0x430173
lea ecx, [ebx + 0x147c]
push str.Office_2000
call fcn.00401759
push 3
mov ecx, ebx
call fcn.0041f334
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004010af
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00435c67
call fcn.0045515b
ret
Function at 0x430190
Capabilities:
Persist via run registry key

Disassembly:
push 0x20
mov eax, 0x472c2f
call fcn.004550bc
mov ebx, ecx
lea ecx, [ebp - 0x2c]
call fcn.00435c47
and dword [ebp - 4], 0
call fcn.00442144
push eax
lea ecx, [ebp - 0x10]
call fcn.0040132d
push SysReAllocStringLen
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00435a09
push 0xffffffffffffffff
lea ecx, [ebx + 0x1450]
push 0
call fcn.0044a148
lea esi, [ebx + 0x144c]
mov edi, 0x477979
push edi
mov ecx, esi
call fcn.00401759
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
test eax, eax
je 0x4302a1
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push edi
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.AppData
mov byte [ebp - 4], 2
call fcn.00401c93
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00436249
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.0040170c
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.004010af
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
je 0x4302a1
push str.MicrosoftOfficeRecent
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.0040177e
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.0040170c
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.004010af
lea ecx, [ebx + 0x1450]
mov eax, dword [ecx + 8]
lea edx, [ebp - 0x10]
push edx
push eax
call fcn.0044a503
cmp dword [ebx + 0x1458], 0
je 0x4302c3
lea ecx, [ebx + 0x147c]
push 0x48d298
call fcn.00401759
push 3
mov ecx, ebx
call fcn.0041f334
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004010af
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00435c67
call fcn.0045515b
ret
Function at 0x431df1
Capabilities:
Persist via run registry key

Disassembly:
push 0x20
mov eax, 0x473055
call fcn.004550bc
mov edi, ecx
lea ecx, [ebp - 0x2c]
call fcn.00435c47
and dword [ebp - 4], 0
call fcn.00442144
push eax
lea ecx, [ebp - 0x14]
call fcn.0040132d
push SysReAllocStringLen
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00435a09
push 0xffffffffffffffff
lea ecx, [edi + 0x1450]
push 0
call fcn.0044a148
lea esi, [edi + 0x144c]
mov ebx, 0x477979
push ebx
mov ecx, esi
call fcn.00401759
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
test eax, eax
je 0x431ecd
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push ebx
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.Cache
mov byte [ebp - 4], 2
call fcn.00401c93
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00436249
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.0040170c
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.004010af
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
je 0x431ecd
lea ecx, [edi + 0x1450]
mov eax, dword [ecx + 8]
push esi
push eax
call fcn.0044a503
cmp dword [edi + 0x1458], 0
je 0x431f06
lea ecx, [edi + 0x147c]
push 0x48d600
call fcn.00401759
push 3
mov ecx, edi
call fcn.0041f334
push 1
push 0
push ecx
mov dword [ebp - 0x1c], esp
mov ecx, esp
push esi
call fcn.00401464
mov ecx, edi
call fcn.0041f102
push str.Content.IE5
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.0040177e
add esp, 0xc
push eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.0040170c
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.004010af
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.index.dat
call fcn.00401c93
push ecx
mov dword [ebp - 0x18], esp
mov ecx, esp
push esi
mov byte [ebp - 4], 5
call fcn.00401464
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.0041aaa6
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004010af
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00435c67
call fcn.0045515b
ret
Function at 0x431f7b
Capabilities:
Persist via run registry key

Disassembly:
push 0x20
mov eax, 0x473098
call fcn.004550bc
mov esi, ecx
lea ecx, [ebp - 0x2c]
call fcn.00435c47
and dword [ebp - 4], 0
call fcn.00442144
push eax
lea ecx, [ebp - 0x14]
call fcn.0040132d
push SysReAllocStringLen
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00435a09
push 0xffffffffffffffff
lea ecx, [esi + 0x1450]
push 0
call fcn.0044a148
lea edi, [esi + 0x144c]
mov ebx, 0x477979
push ebx
mov ecx, edi
call fcn.00401759
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
test eax, eax
je 0x432057
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push ebx
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.Cookies
mov byte [ebp - 4], 2
call fcn.00401c93
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00436249
push eax
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.0040170c
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.004010af
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x432057
lea ecx, [esi + 0x1450]
mov eax, dword [ecx + 8]
push edi
push eax
call fcn.0044a503
cmp dword [esi + 0x1458], 0
je 0x432090
lea ecx, [esi + 0x147c]
push 0x48d62c
call fcn.00401759
push 3
mov ecx, esi
call fcn.0041f334
push 1
push 0
push ecx
mov dword [ebp - 0x1c], esp
mov ecx, esp
push edi
call fcn.00401464
mov ecx, esi
call fcn.0041f102
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.index.dat
call fcn.00401c93
push ecx
mov dword [ebp - 0x18], esp
mov ecx, esp
push edi
mov byte [ebp - 4], 4
call fcn.00401464
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0041aaa6
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004010af
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00435c67
call fcn.0045515b
ret
Function at 0x4320d8
Capabilities:
Persist via run registry key

Disassembly:
push 0x20
mov eax, 0x4730d3
call fcn.004550bc
mov esi, ecx
lea ecx, [ebp - 0x2c]
call fcn.00435c47
and dword [ebp - 4], 0
call fcn.00442144
push eax
lea ecx, [ebp - 0x14]
call fcn.0040132d
push SysReAllocStringLen
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00435a09
push 0xffffffffffffffff
lea ecx, [esi + 0x1450]
push 0
call fcn.0044a148
lea edi, [esi + 0x144c]
mov ebx, 0x477979
push ebx
mov ecx, edi
call fcn.00401759
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00401c93
lea ecx, [ebp - 0x2c]
call fcn.00436002
test eax, eax
je 0x4321b4
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push ebx
call fcn.00401c93
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.History
mov byte [ebp - 4], 2
call fcn.00401c93
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00436249
push eax
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.0040170c
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.004010af
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x4321b4
lea ecx, [esi + 0x1450]
mov eax, dword [ecx + 8]
push edi
push eax
call fcn.0044a503
cmp dword [esi + 0x1458], 0
je 0x4321ed
lea ecx, [esi + 0x147c]
push 0x48d650
call fcn.00401759
push 3
mov ecx, esi
call fcn.0041f334
push 1
push 0
push ecx
mov dword [ebp - 0x1c], esp
mov ecx, esp
push edi
call fcn.00401464
mov ecx, esi
call fcn.0041f102
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004010af
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00435c67
call fcn.0045515b
ret

Function at 0x43220a
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x4a946c]
xor eax, ebp
mov dword [ebp + 0x88], eax
push ebx
push esi
push edi
mov esi, ecx
push 0xffffffffffffffff
lea edi, [esi + 0x1450]
push 0
mov ecx, edi
call fcn.0044a148
lea ebx, [esi + 0x144c]
push 0x477979
mov ecx, ebx
call fcn.00401759
push 0x104
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x432287
lea eax, [ebp - 0x7c]
push str.Prefetch
push eax
call fcn.00457470
pop ecx
pop ecx
lea eax, [ebp - 0x7c]
push eax
mov ecx, ebx
call fcn.00401759
mov eax, dword [edi + 8]
push ebx
push eax
mov ecx, edi
call fcn.0044a503
cmp dword [esi + 0x1458], 0
je 0x4322c0
lea ecx, [esi + 0x147c]
push str.WINDOWS_XP_
call fcn.00401759
push 3
mov ecx, esi
call fcn.0041f334
push 1
push 0
push ecx
mov dword [ebp - 0x80], esp
mov ecx, esp
push ebx
call fcn.00401464
mov ecx, esi
call fcn.0041f102
mov ecx, dword [ebp + 0x88]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004550ad
add ebp, 0x8c
leave
ret