joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58f5b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov byte [ebp - 0x15], al
mov ecx, 0x6fc360
call fcn.0040d3c0
push eax
call fcn.00641e0e
add esp, 4
shl eax, 1
push eax
mov ecx, 0x6fc360
call fcn.0040d3c0
push eax
push 1
push 0x6a4674
lea ecx, [ebp - 0x15]
call fcn.00596540
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor ecx, ecx
mov byte [ebp - 0x16], cl
mov ecx, 0x6fc35c
call fcn.0040d3c0
push eax
call fcn.00641e0e
add esp, 4
shl eax, 1
push eax
mov ecx, 0x6fc35c
call fcn.0040d3c0
push eax
push 1
push 0x6a4688
lea ecx, [ebp - 0x16]
call fcn.00595ee0
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor edx, edx
mov byte [ebp - 0x17], dl
push 4
push 0x6fc36c
push 4
push 0x6a4698
lea ecx, [ebp - 0x17]
call fcn.00597280
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor eax, eax
mov byte [ebp - 0x18], al
push 4
push 0x6fc370
push 4
push 0x6a46b0
lea ecx, [ebp - 0x18]
call fcn.005964f0
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [ebp - 0x20]
call fcn.00413220
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx edx, word [ebp - 0xe]
push edx
movzx eax, word [ebp - 0x12]
push eax
movzx ecx, word [ebp - 0x14]
push ecx
push 0x6a46c4
lea edx, [ebp - 0x20]
push edx
call fcn.00422a10
add esp, 0x14
xor eax, eax
mov byte [ebp - 0x19], al
lea ecx, [ebp - 0x20]
call fcn.0040d3c0
push eax
call fcn.00641e0e
add esp, 4
shl eax, 1
push eax
lea ecx, [ebp - 0x20]
call fcn.0040d3c0
push eax
push 1
push 0x6a46d8
lea ecx, [ebp - 0x19]
call fcn.005963a0
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [ebp - 0x20]
call fcn.00413870
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret
Function at 0x599740
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 4]
call fcn.00599850
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0059a2d0
lea ecx, [ebp - 8]
call fcn.0040d3c0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 8]
call fcn.0040d3c0
push eax
mov ecx, dword [ebp - 4]
add ecx, 0xec
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xec]
mov edx, dword [eax + 8]
call edx
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 8]
call fcn.00413870
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x59a2d0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0063a460
add esp, 0xc
push 0
push 0x1a
lea ecx, [ebp - 0x20c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor edx, edx
mov byte [ebp - 0x20d], dl
lea ecx, [ebp - 0x20d]
call fcn.0059a7b0
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x59a353
lea edx, [ebp - 0x20c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push str.diy.jpg
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004131e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 4
Function at 0x59f890
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
jne 0x59f8b4
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0
jne 0x59f8da
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x59f8e0
push 0
push 0
call fcn.00644f69
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x59f900
Capabilities:
Copy file
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x224], ecx
push 0x20a
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.0063a460
add esp, 0xc
lea ecx, [ebp - 0x210]
push ecx
call fcn.00557cb0
add esp, 4
push 0x5c
mov ecx, dword [ebp + 8]
call fcn.004237d0
mov dword [ebp - 0x220], eax
mov ecx, dword [ebp + 8]
call fcn.0040dcd0
sub eax, dword [ebp - 0x220]
sub eax, 1
push eax
lea edx, [ebp - 0x218]
push edx
mov ecx, dword [ebp + 8]
call fcn.00423820
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x214]
call fcn.004131e0
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x214]
call fcn.004222f0
push 0x6a58e0
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x214]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00413b20
add esp, 8
movzx edx, al
test edx, edx
je 0x59f9fb
push 0
lea ecx, [ebp - 0x214]
call fcn.0040d3c0
push eax
mov ecx, dword [ebp + 8]
call fcn.0040d3c0
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x59f9fb
lea ecx, [ebp - 0x214]
call fcn.00413870
lea ecx, [ebp - 0x218]
call fcn.00413870
jmp 0x59fb44
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.0064f31e
add esp, 8
test eax, eax
jne 0x59fa22
push 0x80
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 1
lea edx, [ebp - 0x210]
push edx
lea ecx, [ebp - 0x214]
call fcn.0040d3c0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x59faa7
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x59fa6d
lea ecx, [ebp - 0x214]
call fcn.00413870
lea ecx, [ebp - 0x218]
call fcn.00413870
jmp 0x59fb44
push 0
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [ebp - 0x214]
call fcn.0040d3c0
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x59faa7
lea ecx, [ebp - 0x214]
call fcn.00413870
lea ecx, [ebp - 0x218]
call fcn.00413870
jmp 0x59fb44
push 0x80
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [ebp + 0xc], 0
je 0x59fb1f
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x21c]
call fcn.004131e0
push ecx
mov ecx, esp
push 0x6a5918
call fcn.004131e0
push ecx
mov ecx, esp
push 0x6a591c
call fcn.004131e0
push ecx
mov ecx, esp
push 0x6a5920
call fcn.004131e0
push ecx
mov ecx, esp
push 0x6a5924
call fcn.004131e0
lea ecx, [ebp - 0x21c]
push ecx
call fcn.00441630
add esp, 0x14
lea ecx, [ebp - 0x21c]
call fcn.00413870
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x224]
call fcn.0059fb60
lea ecx, [ebp - 0x214]
call fcn.00413870
lea ecx, [ebp - 0x218]
call fcn.00413870
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 8
Function at 0x5a0fd0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x124], ecx
mov ecx, dword [ebp - 0x124]
call fcn.004133f0
mov ecx, dword [ebp - 0x124]
add ecx, 8
call fcn.00413220
mov eax, dword [ebp - 0x124]
mov dword [eax], 0
mov ecx, dword [ebp - 0x124]
mov dword [ecx + 4], 0
mov dword [ebp - 0x120], 0x11c
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jae 0x5a1047
mov dword [ebp - 0x128], 1
jmp 0x5a1051
mov dword [ebp - 0x128], 0
mov eax, dword [ebp - 0x124]
mov cl, byte [ebp - 0x128]
mov byte [eax + 0xc], cl
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret
Function at 0x5a3020
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x210], 0
mov ax, word [0x6a5eb4]
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.0063a460
add esp, 0xc
mov dword [ebp - 0x228], 8
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea edx, [ebp - 0x210]
push edx
push 0x6ad3b0
push 1
push 0
push 0x6ad3a0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x220], eax
push 0
lea eax, [ebp - 0x20c]
push eax
push 0x104
push 0x73
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov dword [ebp - 0x214], 0x104
mov dword [ebp - 0x218], 1
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x5a3133
call fcn.005a6700
test eax, eax
je 0x5a3109
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x218]
push ecx
push str.WallpaperSource
push str.SoftwareMicrosoftInternet_ExplorerDesktopGeneral
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
jmp 0x5a3133
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x218]
push ecx
push str.Wallpaper
push str.Control_PanelDesktop
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x5a316f
cmp dword [ebp - 0x210], 0
je 0x5a316f
push 2
push 0x104
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x210]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x210]
push eax
mov ecx, dword [edx + 0x10]
call ecx
cmp dword [ebp - 0x210], 0
je 0x5a3196
mov edx, dword [ebp - 0x210]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x210]
push ecx
mov edx, dword [eax + 8]
call edx
mov dword [ebp - 0x210], 0
call dword [sym.imp.ole32.dll_CoUninitialize]
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp + 8]
call fcn.004131e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 4

Function at 0x5a59a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], ecx
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xf], 0x36
mov byte [ebp - 0xe], 0x30
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x6b
mov byte [ebp - 9], 0x74
mov byte [ebp - 8], 0x6f
mov byte [ebp - 7], 0x70
mov byte [ebp - 6], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.00421610
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 4
Function at 0x5a6650
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x260], ecx
mov ecx, dword [ebp - 0x260]
add ecx, 4
call fcn.0040dd70
movzx eax, al
test eax, eax
je 0x5a668b
mov ecx, dword [ebp + 8]
call fcn.00413220
mov eax, dword [ebp + 8]
jmp 0x5a66ea
mov ecx, dword [ebp - 0x260]
add ecx, 4
call fcn.0040d3c0
push eax
push 0x12c
lea ecx, [ebp - 0x25c]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0
jne 0x5a66d8
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 8]
call fcn.004131e0
mov eax, dword [ebp + 8]
jmp 0x5a66ea
lea eax, [ebp - 0x25c]
push eax
mov ecx, dword [ebp + 8]
call fcn.004131e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5a9740
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x118], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x11c], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x124], ecx
lea ecx, [ebp - 0x114]
call fcn.00413220
call fcn.005e2270
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x5a9870
mov edx, dword [ebp - 0x11c]
push edx
lea eax, [ebp - 0x120]
push eax
call fcn.0055bc10
add esp, 8
mov ecx, eax
call fcn.0040d3c0
push eax
call fcn.005e22a0
add esp, 4
push eax
push 0x6a6044
mov ecx, dword [ebp - 0x10c]
push ecx
call fcn.005e2130
add esp, 0xc
lea ecx, [ebp - 0x120]
call fcn.00413870
cvtsi2sd xmm0, dword [ebp - 0x124]
sub esp, 8
movsd qword [esp], xmm0
call fcn.005e2210
add esp, 8
push eax
push str.succ
mov edx, dword [ebp - 0x10c]
push edx
call fcn.005e2130
add esp, 0xc
mov eax, dword [ebp - 0x10c]
push eax
call fcn.005e2520
add esp, 4
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
je 0x5a9861
push 0
mov ecx, dword [ebp - 0x110]
push ecx
lea ecx, [ebp - 0x108]
call fcn.004214f0
mov ecx, eax
call fcn.0040d3c0
push eax
lea ecx, [ebp - 0x114]
call fcn.00413a70
lea ecx, [ebp - 0x108]
call fcn.00421ba0
mov edx, dword [ebp - 0x110]
push edx
call fcn.0063e41a
add esp, 4
mov eax, dword [ebp - 0x10c]
push eax
call fcn.005e2350
add esp, 4
lea ecx, [ebp - 0x114]
call fcn.0040d3c0
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], 0
mov ecx, dword [ebp - 0x118]
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0x13c], 0x5aa7b0
mov dword [ebp - 0x138], 0
mov edx, dword [ebp - 0x13c]
mov dword [ebp - 0x144], edx
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x140], eax
sub esp, 0x28
mov esi, esp
sub esp, 0x10
mov ecx, esp
push 0x6a5fa3
push 0x6a5fa2
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 0x144]
push eax
push ecx
call fcn.00420f50
add esp, 0x14
mov ecx, esi
call fcn.005aa9b0
lea ecx, [ebp - 0x12c]
push ecx
push 1
lea edx, [ebp - 0x130]
push edx
push str.wpdownloadresult
mov ecx, dword [ebp - 0x118]
add ecx, 0x8c
call fcn.005d2470
mov dword [ebp - 0x134], 0
lea ecx, [ebp - 0x114]
call fcn.00413870
mov eax, dword [ebp - 0x134]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5aa240
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x1d8], ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x1ec]
call fcn.00614c60
lea ecx, [ebp - 0x4c]
call fcn.004219f0
lea ecx, [ebp - 0x34]
call fcn.004219f0
lea ecx, [ebp - 0x1c]
call fcn.004219f0
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x1ec]
call fcn.00614e70
lea edx, [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x1ec]
call fcn.00614e70
mov eax, dword [ebp - 0x1d8]
add eax, 0xd0
push eax
lea ecx, [ebp - 0x1ec]
call fcn.00614e70
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x1ec]
call fcn.00614e70
mov edx, dword [ebp - 0x1d8]
cmp dword [edx + 0xa0], 0
jne 0x5aa2f1
lea ecx, [ebp - 0x1c]
call fcn.00421c50
lea ecx, [ebp - 0x34]
call fcn.00421c50
lea ecx, [ebp - 0x4c]
call fcn.00421c50
jmp 0x5aa4ce
lea ecx, [ebp - 0x1e4]
call fcn.00413220
call fcn.005e2270
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0
je 0x5aa3d7
push 0xfde9
mov ecx, dword [ebp - 0x1d8]
add ecx, 0xd0
call fcn.00424f40
push eax
lea ecx, [ebp - 0xd0]
call fcn.00421730
mov ecx, eax
call fcn.0040d3c0
push eax
call fcn.005e22a0
add esp, 4
push eax
push 0x6a614c
mov eax, dword [ebp - 0x1dc]
push eax
call fcn.005e2130
add esp, 0xc
lea ecx, [ebp - 0xd0]
call fcn.00421ba0
mov ecx, dword [ebp - 0x1dc]
push ecx
call fcn.005e2520
add esp, 4
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0
je 0x5aa3c8
push 0xfde9
mov edx, dword [ebp - 0x1e0]
push edx
lea ecx, [ebp - 0x1d4]
call fcn.004214f0
mov ecx, eax
call fcn.0040d3c0
push eax
lea ecx, [ebp - 0x1e4]
call fcn.00413a70
lea ecx, [ebp - 0x1d4]
call fcn.00421ba0
mov eax, dword [ebp - 0x1e0]
push eax
call fcn.0063e41a
add esp, 4
mov ecx, dword [ebp - 0x1dc]
push ecx
call fcn.005e2350
add esp, 4
mov ecx, dword [ebp - 0x1d8]
add ecx, 0xd0
call fcn.00425070
movzx edx, al
test edx, edx
jne 0x5aa49e
lea ecx, [ebp - 0x1e4]
call fcn.0040d3c0
mov dword [ebp - 0x1f8], eax
mov dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x1f0], eax
mov dword [ebp - 0x200], 0x5aa7f0
mov dword [ebp - 0x1fc], 0
mov ecx, dword [ebp - 0x200]
mov dword [ebp - 0x208], ecx
mov edx, dword [ebp - 0x1fc]
mov dword [ebp - 0x204], edx
sub esp, 0x28
mov esi, esp
sub esp, 0x10
mov eax, esp
push 0x6a5fa3
push 0x6a5fa2
lea ecx, [ebp - 0x1f0]
push ecx
lea edx, [ebp - 0x208]
push edx
push eax
call fcn.00420f50
add esp, 0x14
mov ecx, esi
call fcn.005aa9b0
lea eax, [ebp - 0x1f4]
push eax
push 1
lea ecx, [ebp - 0x1f8]
push ecx
push 0x6a6154
mov ecx, dword [ebp - 0x1d8]
add ecx, 0x8c
call fcn.005d2470
push str.CStaticWallPaperTab::OnIPCLoginSucess
call fcn.005564a0
add esp, 4
lea ecx, [ebp - 0x1e4]
call fcn.00413870
lea ecx, [ebp - 0x1c]
call fcn.00421c50
lea ecx, [ebp - 0x34]
call fcn.00421c50
lea ecx, [ebp - 0x4c]
call fcn.00421c50
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 4
Function at 0x5ab180
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 1
push 0
push 0
mov ecx, 0x6fbb3c
call fcn.0040d3c0
push eax
push 0x6a705c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
call fcn.00414ec0
mov esp, ebp
pop ebp
ret 0xc

Function at 0x5abdf0
Capabilities:
Check if file exists
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0xc]
push edx
mov ecx, dword [ebp - 4]
call fcn.005ac190
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.005ac390
lea ecx, [ebp - 0xc]
call fcn.0040d3c0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5abe3f
push 1
mov ecx, dword [ebp - 4]
call fcn.005ac3d0
jmp 0x5abf69
lea ecx, [ebp - 8]
call fcn.0040d3c0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5abe9f
push 0
lea ecx, [ebp - 0xc]
call fcn.0040d3c0
push eax
lea ecx, [ebp - 8]
call fcn.0040d3c0
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x5abe81
push 1
mov ecx, dword [ebp - 4]
call fcn.005ac3d0
jmp 0x5abe9a
push 0x10
push 0x6a7330
push 0x6a7338
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x5abf69
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.005ac110
test eax, eax
jne 0x5abf69
mov edx, dword [ebp - 4]
cmp dword [edx + 0x28], 0
jne 0x5abf05
push 0x6fe300
push 0x2c
call fcn.00613623
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x5abee1
mov ecx, dword [ebp - 0x10]
call fcn.005aea30
mov dword [ebp - 0x14], eax
jmp 0x5abee8
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x28], ecx
mov edx, dword [ebp - 4]
cmp dword [edx + 0x28], 0
je 0x5abf05
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28]
call fcn.005ae780
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x28], 0
je 0x5abf69
mov edx, dword [ebp + 0xc]
push edx
push 0
call fcn.005abcf0
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
lea ecx, [ebp - 8]
call fcn.0040d3c0
push eax
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28]
call fcn.005ae840
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0xc]
call fcn.0040d3c0
push eax
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x24]
call fcn.005acad0
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x30
call fcn.005ad2d0
lea ecx, [ebp - 0x24]
call fcn.00427050
lea ecx, [ebp - 8]
call fcn.00413870
lea ecx, [ebp - 0xc]
call fcn.00413870
mov esp, ebp
pop ebp
ret 8
Function at 0x5abf80
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0xc], 0
je 0x5ac087
lea edx, [ebp - 8]
push edx
mov ecx, dword [ebp - 4]
add ecx, 0x30
call fcn.004a0120
jmp 0x5abfb8
lea ecx, [ebp - 8]
call fcn.0049fc90
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x30
call fcn.004a0240
push eax
lea ecx, [ebp - 8]
call fcn.00413ae0
movzx ecx, al
test ecx, ecx
je 0x5ac087
mov edx, dword [ebp - 0xc]
push edx
lea ecx, [ebp - 8]
call fcn.005acb90
push eax
call fcn.00429e60
add esp, 8
movzx eax, al
test eax, eax
je 0x5ac082
cmp dword [ebp - 0x10], 0
je 0x5ac05d
push 0
lea ecx, [ebp - 8]
call fcn.005acb90
add eax, 4
mov ecx, eax
call fcn.0040d3c0
push eax
mov ecx, dword [ebp - 0xc]
push ecx
lea edx, [ebp - 0x14]
push edx
mov ecx, dword [ebp - 4]
call fcn.005ac390
mov ecx, eax
call fcn.0040d3c0
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x14]
call fcn.00413870
cmp dword [ebp - 0x18], 0
je 0x5ac051
push 1
mov ecx, dword [ebp - 4]
call fcn.005ac3d0
jmp 0x5ac05b
push 0
mov ecx, dword [ebp - 4]
call fcn.005ac3d0
jmp 0x5ac067
push 0
mov ecx, dword [ebp - 4]
call fcn.005ac3d0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x24]
push edx
mov ecx, dword [ebp - 4]
add ecx, 0x30
call fcn.005ad260
jmp 0x5ac087
jmp 0x5abfb0
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5ac190
Capabilities:
Check if file exists
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x48], ecx
mov ecx, 0x6fbb3c
call fcn.0040dd70
movzx eax, al
test eax, eax
je 0x5ac26e
lea ecx, [ebp - 0x1c]
call fcn.004219f0
lea ecx, [ebp - 0x1c]
push ecx
call sym.birdwp.exe_bool___cdecl_Loop::GetDLPath_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t____
add esp, 4
lea ecx, [ebp - 0x1c]
call fcn.00424f40
push eax
mov ecx, 0x6fbb3c
call fcn.00413a70
mov ecx, 0x6fbb3c
call fcn.0040dd70
movzx edx, al
test edx, edx
je 0x5ac218
call fcn.0052ccf0
mov eax, dword [eax + 4]
push eax
lea ecx, [ebp - 0x40]
push ecx
call fcn.00456650
add esp, 8
push eax
mov ecx, 0x6fbb3c
call fcn.0040d360
lea ecx, [ebp - 0x40]
call fcn.00413870
mov ecx, 0x6fbb3c
call fcn.0040dd70
movzx edx, al
test edx, edx
jne 0x5ac261
xor eax, eax
mov byte [ebp - 0x35], al
mov ecx, 0x6fbb3c
call fcn.0040dcd0
shl eax, 1
push eax
mov ecx, 0x6fbb3c
call fcn.00422c50
push eax
push 1
push 0x6a7360
lea ecx, [ebp - 0x35]
call fcn.005ace00
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [ebp - 0x1c]
call fcn.00421c50
jmp 0x5ac2f4
mov ecx, 0x6fbb3c
call fcn.0040d3c0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x5ac2f4
call fcn.0052ccf0
mov ecx, dword [eax + 4]
push ecx
lea edx, [ebp - 0x44]
push edx
call fcn.00456650
add esp, 8
push eax
mov ecx, 0x6fbb3c
call fcn.0040d360
lea ecx, [ebp - 0x44]
call fcn.00413870
mov ecx, 0x6fbb3c
call fcn.0040dd70
movzx eax, al
test eax, eax
jne 0x5ac2f4
xor ecx, ecx
mov byte [ebp - 0x36], cl
mov ecx, 0x6fbb3c
call fcn.0040dcd0
shl eax, 1
push eax
mov ecx, 0x6fbb3c
call fcn.00422c50
push eax
push 1
push str.SaveImagePath
lea ecx, [ebp - 0x36]
call fcn.005acdb0
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, 0x6fbb3c
call fcn.0040dd70
movzx edx, al
test edx, edx
je 0x5ac317
push 0x6a7398
mov ecx, dword [ebp + 8]
call fcn.004131e0
mov eax, dword [ebp + 8]
jmp 0x5ac379
push 0x6fbb3c
lea ecx, [ebp - 0x3c]
call fcn.00421650
mov eax, dword [ebp + 0x10]
push eax
call fcn.00643869
add esp, 4
push eax
lea ecx, [ebp - 0x34]
push ecx
call fcn.00606cc6
add esp, 8
mov ecx, eax
call fcn.00424f40
push eax
lea ecx, [ebp - 0x3c]
call fcn.004318c0
lea ecx, [ebp - 0x34]
call fcn.00421c50
push 0x6a739c
lea ecx, [ebp - 0x3c]
call fcn.004318c0
lea edx, [ebp - 0x3c]
push edx
mov ecx, dword [ebp + 8]
call fcn.00421650
lea ecx, [ebp - 0x3c]
call fcn.00413870
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 0xc