joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4089a5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00407aae
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.00407ae0
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00407a95
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.00407ad0
invalid
Function at 0x406630
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov ecx, dword [ebp + 8]
call fcn.00406760
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x406650
xor eax, eax
jmp 0x4066db
push 0x208
push 0
lea ecx, [ebp - 0x218]
push ecx
call fcn.00537020
add esp, 0xc
push 0x208
push 0
lea edx, [ebp - 0x218]
push edx
call fcn.00537020
add esp, 0xc
mov dword [ebp - 8], 0
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x208
lea eax, [ebp - 0x218]
push eax
call fcn.00406900
mov dword [ebp - 0x10], eax
push 0
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x218]
push edx
call fcn.00541100
add esp, 4
push eax
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x406760
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x406779
jmp 0x40682b
push 0x104
push 0
lea ecx, [ebp - 0x108]
push ecx
call fcn.00537020
add esp, 0xc
lea edx, [ebp - 0x108]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x4067aa
jmp 0x40682b
push 0x104
push 0
mov eax, dword [ebp - 4]
add eax, 4
push eax
call fcn.00537020
add esp, 0xc
mov ecx, dword [ebp - 4]
add ecx, 4
push ecx
push 0
push 0x5f4b88
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov eax, dword [ebp - 4]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x5f4b8c
mov ecx, dword [ebp - 4]
add ecx, 4
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionA]
mov edx, dword [ebp - 4]
add edx, 4
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 4
push 0
push 7
push 0xc01200a0
mov eax, dword [ebp - 4]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret

Function at 0x406bf0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2024
call fcn.00472110
cmp dword [ebp + 8], 0
jne 0x406c07
xor eax, eax
jmp 0x406c74
push 0x1e
push 0
lea eax, [ebp - 0x24]
push eax
call fcn.00537020
add esp, 0xc
mov dword [ebp - 4], 0x1000
mov dword [ebp - 0x20], 3
push 0x2000
push 0
lea ecx, [ebp - 0x2024]
push ecx
call fcn.00537020
add esp, 0xc
push 0x1000
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x2024]
push eax
call fcn.00553e32
add esp, 0xc
lea ecx, [ebp - 0x2024]
mov dword [ebp - 0x1c], ecx
mov edx, 0x614
mov word [ebp - 0x14], dx
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x406ef0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88c
cmp dword [ebp + 8], 0
jne 0x406f06
xor eax, eax
jmp 0x4070f1
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x406f17
xor eax, eax
jmp 0x4070f1
cmp dword [ebp + 0xc], 0
jne 0x406f24
xor eax, eax
jmp 0x4070f1
mov edx, dword [ebp + 0xc]
movzx eax, word [edx]
test eax, eax
jne 0x406f35
xor eax, eax
jmp 0x4070f1
mov ecx, dword [ebp + 8]
push ecx
call fcn.00553b5f
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x104
jl 0x406f54
xor eax, eax
jmp 0x4070f1
push 0x410
push 0
lea edx, [ebp - 0x88c]
push edx
call fcn.00537020
add esp, 0xc
push 0x5f4bac
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x88c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x47c]
call fcn.004079d0
lea edx, [ebp - 0x88c]
push edx
lea ecx, [ebp - 0x47c]
call fcn.00408530
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4070d1
lea ecx, [ebp - 0x47c]
call fcn.00408c70
test eax, eax
je 0x406fc9
lea ecx, [ebp - 0x47c]
call fcn.00408690
mov dword [ebp - 0xc], eax
jmp 0x406fa0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x47c]
call fcn.00408960
lea ecx, [ebp - 0x47c]
call fcn.00408c50
test eax, eax
je 0x407001
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 4]
call fcn.00407c80
push eax
call fcn.00406ef0
add esp, 8
jmp 0x4070b6
lea ecx, [ebp - 4]
call fcn.00407c80
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.00554310
add esp, 8
test eax, eax
jne 0x4070b6
lea ecx, [ebp - 4]
call fcn.00407c80
push eax
call fcn.00407100
add esp, 4
test eax, eax
jne 0x4070b6
lea ecx, [ebp - 8]
call fcn.00407970
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.004073d0
add esp, 8
test eax, eax
je 0x407086
push 4
push 0
lea ecx, [ebp - 8]
call fcn.00407c80
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 0x5f4bb4
call fcn.00432e00
add esp, 0xc
jmp 0x4070ae
push 4
push 0
lea ecx, [ebp - 4]
call fcn.00407c80
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 4]
push eax
push str.delete_file:_s_by_pending:_s
call fcn.00432e00
add esp, 0xc
lea ecx, [ebp - 8]
call fcn.00407ac0
lea ecx, [ebp - 0x47c]
call fcn.00408690
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 4]
call fcn.00407ac0
jmp 0x406fa0
lea ecx, [ebp - 0x47c]
call fcn.004083d0
mov dword [ebp - 0x18], 1
lea ecx, [ebp - 0x47c]
call fcn.00407af0
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x407100
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x407122
mov eax, 1
jmp 0x407191
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x407137
mov eax, 1
jmp 0x407191
push 0x80
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40715f
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40715f
mov eax, 1
jmp 0x407191
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x40718f
mov edx, dword [ebp - 4]
and edx, 0x10
je 0x40718f
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x40718f
mov eax, 1
jmp 0x407191
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4071a0
Capabilities:
Check if file exists
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4071d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x5f4c2c
call fcn.00432e00
add esp, 0xc
mov eax, 1
jmp 0x40723d
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4071ed
mov eax, 1
jmp 0x40723d
push 0x80
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40722d
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40722d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, dword [ebp + 8]
push edx
push str.delete__s_failed__error_d
call fcn.00432e00
add esp, 0xc
mov eax, 1
jmp 0x40723d
push 4
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x407250
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x888
cmp dword [ebp + 8], 0
jne 0x407266
xor eax, eax
jmp 0x4073bf
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x407277
xor eax, eax
jmp 0x4073bf
mov edx, dword [ebp + 8]
push edx
call fcn.00553b5f
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x104
jl 0x407296
xor eax, eax
jmp 0x4073bf
push 0x410
push 0
lea eax, [ebp - 0x888]
push eax
call fcn.00537020
add esp, 0xc
push 0x5f4c9c
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x888]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4072f4
mov ecx, dword [ebp - 4]
and ecx, 1
je 0x4072f4
mov edx, dword [ebp - 4]
and edx, 0xfffffffe
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x478]
call fcn.004079d0
lea edx, [ebp - 0x888]
push edx
lea ecx, [ebp - 0x478]
call fcn.00408530
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x407393
lea ecx, [ebp - 0x478]
call fcn.00408c70
test eax, eax
je 0x407339
lea ecx, [ebp - 0x478]
call fcn.00408690
mov dword [ebp - 8], eax
jmp 0x407314
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x478]
call fcn.00408960
lea ecx, [ebp - 0x478]
call fcn.00408c50
test eax, eax
je 0x40736a
lea ecx, [ebp - 0xc]
call fcn.00407c80
push eax
call fcn.00407250
add esp, 4
jmp 0x40737b
lea ecx, [ebp - 0xc]
call fcn.00407c80
push eax
call fcn.004071a0
add esp, 4
lea ecx, [ebp - 0x478]
call fcn.00408690
mov dword [ebp - 8], eax
lea ecx, [ebp - 0xc]
call fcn.00407ac0
jmp 0x407314
lea ecx, [ebp - 0x478]
call fcn.004083d0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00406bf0
add esp, 4
mov dword [ebp - 0x14], 1
lea ecx, [ebp - 0x478]
call fcn.00407af0
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x4073d0
Capabilities:
Check if file exists
Get common file path
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov ecx, dword [ebp + 8]
call fcn.00408d00
movzx eax, al
test eax, eax
je 0x4073ef
xor eax, eax
jmp 0x4075d8
mov ecx, dword [ebp + 8]
call fcn.00407c80
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x407409
xor eax, eax
jmp 0x4075d8
lea ecx, [ebp - 4]
call fcn.00407970
push 0x208
push 0
lea ecx, [ebp - 0x220]
push ecx
call fcn.00537020
add esp, 0xc
push 0x208
push 0
lea edx, [ebp - 0x428]
push edx
call fcn.00537020
add esp, 0xc
push 0x104
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [ebp - 0x428]
push ecx
call fcn.00556f65
add esp, 4
push 0
mov ecx, dword [ebp + 8]
call fcn.00407c40
mov word [ebp - 8], ax
movzx edx, word [ebp - 8]
push edx
call fcn.005542e0
add esp, 4
mov word [ebp - 8], ax
mov eax, 2
imul ecx, eax, 0
movzx edx, word [ebp + ecx - 0x428]
movzx eax, word [ebp - 8]
cmp edx, eax
jne 0x4074a9
lea ecx, [ebp - 0x220]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x4074ff
push 0
mov ecx, dword [ebp + 8]
call fcn.00408850
movzx edx, ax
push edx
push 0x5f4ca0
push 0x104
lea eax, [ebp - 0x220]
push eax
call fcn.00409450
add esp, 0x10
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4074ff
lea edx, [ebp - 0x220]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push 2
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0xc]
call fcn.00407930
lea edx, [ebp - 4]
push edx
push 0
lea eax, [ebp - 0xc]
push eax
call fcn.00408b10
add esp, 0xc
lea ecx, [ebp - 0xc]
call fcn.00407ac0
lea ecx, [ebp - 4]
call fcn.00407c80
push eax
mov ecx, dword [ebp + 8]
call fcn.00407c80
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x407576
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push str.move__s_to__s__failed__error_d
call fcn.00432e00
add esp, 0x10
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 4]
call fcn.00407ac0
mov eax, dword [ebp - 0x10]
jmp 0x4075d8
mov ecx, dword [ebp + 8]
call fcn.00407c80
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4075b0
lea ecx, [ebp - 4]
call fcn.00407c80
push eax
call fcn.004071a0
add esp, 4
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 4]
call fcn.00407ac0
mov eax, dword [ebp - 0x14]
jmp 0x4075d8
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00407c00
mov dword [ebp - 0x18], 1
lea ecx, [ebp - 4]
call fcn.00407ac0
mov eax, dword [ebp - 0x18]
jmp 0x4075d8
mov esp, ebp
pop ebp
ret
Function at 0x408b10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x110c
call fcn.00472110
mov ecx, dword [ebp + 8]
call fcn.00408aa0
cmp eax, 0x104
jle 0x408b33
xor eax, eax
jmp 0x408c42
mov dword [ebp - 8], 0x400
push 0x800
push 0
lea eax, [ebp - 0x110c]
push eax
call fcn.00537020
add esp, 0xc
push 0x800
push 0
lea ecx, [ebp - 0x90c]
push ecx
call fcn.00537020
add esp, 0xc
mov ecx, dword [ebp + 8]
call fcn.00407c80
push eax
lea edx, [ebp - 0x110c]
push edx
call fcn.00407840
add esp, 8
cmp dword [ebp + 0xc], 0
je 0x408b9f
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax]
test ecx, ecx
je 0x408b9f
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x110c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov dword [ebp - 0xc], 0xa
push 0x100
push 0
lea ecx, [ebp - 0x10c]
push ecx
call fcn.00537020
add esp, 0xc
mov dword [ebp - 4], 0
jmp 0x408bce
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0xa
jge 0x408c40
push 0x80
lea eax, [ebp - 0x10c]
push eax
call fcn.00408e60
add esp, 8
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x110c]
push edx
lea eax, [ebp - 0x90c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str..tmp
lea ecx, [ebp - 0x90c]
push ecx
call fcn.00407820
add esp, 8
lea edx, [ebp - 0x90c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x408c3e
lea eax, [ebp - 0x90c]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.00407c20
mov eax, 1
jmp 0x408c42
jmp 0x408bc5
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x409500
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x409524
xor eax, eax
jmp 0x4095a4
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40953b
xor eax, eax
jmp 0x4095a4
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x409587
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x409587
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x40955e
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x409593
xor eax, eax
jmp 0x4095a4
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x4095a1
xor eax, eax
jmp 0x4095a4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x40cce0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40cd64
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40cd3b
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x14], 0
je 0x40cd32
push 0
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov eax, 1
jmp 0x40cd66
mov edx, dword [ebp - 8]
add edx, 0x10
push edx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.0040ec60
mov ecx, dword [ebp - 8]
add ecx, 0x10
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40ce60
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40ce91
jmp 0x40cf49
push 0x22c
push 0
lea eax, [ebp - 0x240]
push eax
call fcn.00537020
add esp, 0xc
mov dword [ebp - 0x240], 0x22c
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x40ced1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40cf49
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x238]
je 0x40cf2b
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x21c]
push eax
call fcn.00554310
add esp, 8
test eax, eax
jne 0x40cf2b
mov ecx, dword [ebp - 0x238]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.0040cf50
test eax, eax
je 0x40cf2b
mov edx, dword [ebp - 0x238]
mov dword [ebp - 8], edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0040ec40
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40cee1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret 8
Function at 0x411a50
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x221c
call fcn.00472110
push 0x208
push 0
lea eax, [ebp - 0x21c]
push eax
call fcn.00537020
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x411a9e
jmp 0x411ba5
push 0x2000
push 0
lea edx, [ebp - 0x221c]
push edx
call fcn.00537020
add esp, 0xc
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], 0x1000
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x221c]
push ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push str.SOFTWARESuperBookmark_file_pe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x411aee
jmp 0x411ba5
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov dword [ebp - 8], eax
push str..dll
mov edx, dword [ebp - 8]
push edx
call fcn.00554310
add esp, 8
test eax, eax
jne 0x411b32
push 1
lea eax, [ebp - 0x221c]
push eax
push str.Uninst
lea ecx, [ebp - 0x21c]
push ecx
call fcn.00411bb0
add esp, 0x10
jmp 0x411ba5
push 0x5f55e8
mov edx, dword [ebp - 8]
push edx
call fcn.00554310
add esp, 8
test eax, eax
jne 0x411ba5
lea eax, [ebp - 0x221c]
push eax
lea ecx, [ebp - 4]
call fcn.00407930
push str.__uninstall__productbizhi
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x14]
push edx
call fcn.00416100
add esp, 0xc
push eax
lea ecx, [ebp - 4]
call fcn.00407c00
lea ecx, [ebp - 0x14]
call fcn.00407ac0
push 0xc350
push 1
push 1
lea ecx, [ebp - 4]
call fcn.00407c80
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00411c30
add esp, 0x14
lea ecx, [ebp - 4]
call fcn.00407ac0
mov esp, ebp
pop ebp
ret

Function at 0x411c30
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x411c44
jmp 0x411c9f
mov ecx, dword [ebp + 8]
push ecx
call fcn.00440b40
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x5f50d0
call fcn.00432e00
add esp, 0xc
mov ecx, dword [ebp + 0x18]
push ecx
push 0
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 1
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00440d40
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
push eax
push str.call_exe_return___d___path__s___cmd__s___sync__d_
call fcn.00432e00
add esp, 0x14
mov esp, ebp
pop ebp
ret