joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb74d68
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push esi
push edi
mov esi, edx
mov edi, 0x104
push edi
push esi
mov edx, 0xa16090
call fcn.00b74daf
test al, al
je 0xb74da8
push 0xa16078
push edi
push esi
call dword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchAppend]
test eax, eax
jne 0xb74da8
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0xb74da8
test al, 0x10
jne 0xb74da8
mov al, 1
jmp 0xb74daa
xor al, al
pop edi
pop esi
ret 4

Function at 0xb74daf
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 2
push edx
push 0
push ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
neg eax
sbb al, al
inc al
leave
ret 8

Function at 0xb76e96
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push ebx
push esi
push edi
push eax
push 1
xor esi, esi
push esi
push 0xa16f30
push reloc.OLEAUT32.dll_SysReAllocString
mov ebx, esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
push 4
pop edi
test eax, eax
jne 0xb76ef1
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0xa16f00
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0xb76ee8
cmp dword [ebp - 0xc], ebx
setne bl
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 1
push esi
push 0x9f3e90
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0xb76f44
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0xa16f00
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0xb76f3b
test ebx, ebx
jne 0xb76f38
cmp dword [ebp - 0xc], esi
jne 0xb76f38
mov ebx, esi
jmp 0xb76f3b
xor ebx, ebx
inc ebx
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor eax, eax
test ebx, ebx
pop edi
pop esi
sete al
pop ebx
leave
ret
Function at 0xb785f6
Capabilities:
Get common file path

Disassembly:
push 0xe4
mov eax, 0xb009c7
call fcn.00af8e2b
mov ebx, ecx
lea eax, [ebp - 0xcd]
mov byte [ebp - 0xcd], 0x44
push eax
push dword [ebp - 0xdc]
lea ecx, [ebp - 0xcc]
call fcn.00b66912
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, ecx
mov dword [ebp - 0xd8], ecx
lea eax, [ebp - 0xd4]
mov byte [ebp - 4], 2
push eax
push ecx
push 0x4000
push 0x9f764c
mov dword [ebp - 0xd4], ecx
call dword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetKnownFolderPath]
test eax, eax
js 0xb786e6
and dword [ebp - 0xe4], edi
lea eax, [ebp - 0xd8]
mov dword [ebp - 0xe8], eax
lea eax, [ebp - 0xe4]
push eax
push 1
push 0xa168b0
push dword [ebp - 0xd4]
mov byte [ebp - 0xe0], 1
call dword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathAllocCombine]
cmp byte [ebp - 0xe0], 0
je 0xb786e6
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0xf0], eax
mov ecx, dword [eax]
mov dword [ebp - 0xec], ecx
test ecx, ecx
je 0xb786de
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push dword [ebp - 0xec]
mov esi, eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0xdc]
mov dword [eax], ecx
xor esi, esi
mov ecx, ebx
push esi
push dword [ebp - 0xd8]
call fcn.00b7a41e
test al, al
je 0xb786ff
xor edi, edi
inc edi
jmp 0xb7873b
push esi
push 0xa169dc
mov ecx, ebx
call fcn.00b79acd
test al, al
je 0xb78714
push 4
jmp 0xb7873a
push esi
push 0xa16950
call fcn.00b79919
test al, al
je 0xb78727
push 3
jmp 0xb7873a
push esi
push 0xa16a58
mov ecx, ebx
call fcn.00b7a41e
test al, al
je 0xb7873b
push 5
pop edi
push edi
lea ecx, [ebp - 0xcc]
call fcn.00b76061
mov byte [ebp - 4], 1
cmp dword [ebp - 0xd4], esi
je 0xb7875f
push dword [ebp - 0xd4]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov byte [ebp - 4], 0
cmp dword [ebp - 0xd8], esi
je 0xb78777
push dword [ebp - 0xd8]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0xcc], 0x9d6260
call fcn.00b6842b
lea ecx, [ebp - 0x14]
call fcn.00b7b600
lea ecx, [ebp - 0x20]
call fcn.00a48c27
lea ecx, [ebp - 0x88]
call fcn.00a7d7ad
cmp dword [ebp - 0xb0], 1
jne 0xb787cd
mov dword [ebp - 0xb0], 2
call fcn.00ab6005
lea edx, [ebp - 0xa8]
mov ecx, dword [eax + 4]
call fcn.00b5f842
mov dword [ebp - 0xb0], 3
cmp dword [ebp - 0xbc], esi
je 0xb787ea
lea ecx, [ebp - 0xc8]
call fcn.00a59db6
call fcn.00af8dd5
ret
Function at 0xb79839
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
lea eax, [ebp - 4]
push esi
push eax
xor esi, esi
push esi
push esi
push 0x9f766c
call dword [sym.imp.api_ms_win_storage_exports_internal_l1_1_0.dll_SHGetKnownFolderIDList]
test eax, eax
js 0xb7989c
push 0x38
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x40], 0x3c
push esi
push eax
call fcn.00ab4bf6
mov eax, dword [ebp - 4]
add esp, 0xc
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x3c], 0x10000c
mov dword [ebp - 0x24], 1
push eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_shell_namespace_l1_1_0.dll_ILFree]
pop esi
leave
ret 4

Function at 0xb798a1
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
xor edi, edi
lea eax, [ebp - 4]
push edi
push edi
push eax
push edi
push 0x9f8c78
mov esi, ecx
mov dword [ebp - 4], edi
call dword [sym.imp.api_ms_win_shell_namespace_l1_1_0.dll_SHParseDisplayName]
test eax, eax
js 0xb79906
push 0x38
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x40], 0x3c
push edi
push eax
call fcn.00ab4bf6
mov eax, dword [ebp - 4]
add esp, 0xc
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x3c], 0x10000c
mov dword [ebp - 0x24], 1
push eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], 0x9f9d24
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [ebp - 4]
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
pop edi
pop esi
leave
ret 4
Function at 0xb799bc
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0xb00a80
call fcn.00af8e62
mov esi, ecx
lea eax, [ebp + 8]
xor ebx, ebx
push eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.00b6746b
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 1
push eax
push ebx
push ebx
push 2
push ebx
push dword [ebp - 0x14]
mov edi, reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x1c], ebx
push edi
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHRegGetValueW]
mov ecx, dword [ebp + 4]
test eax, eax
jns 0xb79a11
push eax
push 0x9f9bd4
mov edx, 0x1a02
call fcn.00b607a3
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0xb79a87
shr eax, 1
lea ecx, [ebp - 0x18]
push eax
call fcn.00b672a7
mov byte [ebp - 4], 2
mov ecx, edi
push dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
push dword [ebp - 0x18]
push 2
push ebx
call fcn.00aac1c5
mov ecx, dword [ebp + 4]
test eax, eax
jns 0xb79a4e
push eax
push 0x9f9bd4
mov edx, 0x1a06
jmp 0xb79a0c
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp - 0x18]
call fcn.00b7a41e
mov byte [ebp - 4], 1
mov bl, al
cmp dword [ebp - 0x18], 0
je 0xb79a70
push dword [ebp - 0x18]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov byte [ebp - 4], 0
cmp dword [ebp - 0x14], 0
je 0xb79a83
push dword [ebp - 0x14]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov al, bl
jmp 0xb79ac5
mov byte [ebp - 4], bl
cmp dword [ebp - 0x14], 0
je 0xb79ac3
push dword [ebp - 0x14]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
jmp 0xb79ac3
xor al, al
call fcn.00af8dc0
ret 8
Function at 0xb79acd
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0xb00aab
call fcn.00af8e62
mov esi, ecx
push ecx
xor ebx, ebx
lea edx, [ebp + 8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.00b6740d
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 1
push eax
push ebx
push ebx
push 2
push ebx
push dword [ebp - 0x18]
mov edi, SysReAllocString
mov dword [ebp - 0x1c], ebx
push edi
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHRegGetValueW]
mov ecx, dword [ebp + 4]
test eax, eax
jns 0xb79b22
push eax
push 0x9f9bd4
mov edx, 0x1a29
call fcn.00b607a3
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0xb79b98
shr eax, 1
lea ecx, [ebp - 0x14]
push eax
call fcn.00b672a7
mov byte [ebp - 4], 2
mov ecx, edi
push dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
push dword [ebp - 0x14]
push 2
push ebx
call fcn.00aac1c5
mov ecx, dword [ebp + 4]
test eax, eax
jns 0xb79b5f
push eax
push 0x9f9bd4
mov edx, 0x1a2d
jmp 0xb79b1d
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], ebx
push eax
push dword [ebp - 0x14]
call dword [sym.imp.api_ms_win_shcore_obsolete_l1_1_0.dll_CommandLineToArgvW]
mov ecx, dword [ebp + 4]
test eax, eax
jne 0xb79bac
push 0x9f9bd4
mov edx, 0x1a31
call fcn.00b6203c
mov byte [ebp - 4], 1
cmp dword [ebp - 0x14], 0
je 0xb79b98
push dword [ebp - 0x14]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov byte [ebp - 4], bl
cmp dword [ebp - 0x18], 0
je 0xb79c12
push dword [ebp - 0x18]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
jmp 0xb79c12
cmp dword [ebp - 0x20], 0
jle 0xb79b85
push dword [ebp + 0xc]
mov ecx, esi
push dword [eax]
call fcn.00b7a41e
mov byte [ebp - 4], 1
mov bl, al
cmp dword [ebp - 0x14], 0
je 0xb79bd3
push dword [ebp - 0x14]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov byte [ebp - 4], 0
cmp dword [ebp - 0x18], 0
je 0xb79be6
push dword [ebp - 0x18]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov al, bl
jmp 0xb79c14
xor al, al
call fcn.00af8dc0
ret 8
Function at 0xb79c1c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, 0xc97c08
xor edi, edi
push ebx
inc edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0xb79c78
mov esi, 0x104
push edi
push ebx
push 0xa16690
lea eax, [ebp - 0x20c]
inc edi
push esi
push eax
call fcn.00a60c0c
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0xb79c4c
jmp 0xb79cd5
push ebx
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFindExtensionW]
mov ebx, eax
test ebx, ebx
je 0xb79ce5
mov esi, 0x104
lea ecx, [ebp - 0x414]
push ebx
mov edx, esi
call fcn.00a535e0
xor eax, eax
mov word [ebx], ax
mov ebx, 0xc97c08
lea ecx, [ebp - 0x414]
mov eax, edi
push ecx
push eax
push ebx
push 0xa1669c
lea eax, [ebp - 0x20c]
inc edi
push esi
push eax
call fcn.00a60c0c
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0xb79ca2
lea eax, [ebp - 0x20c]
mov edx, esi
push eax
mov ecx, ebx
call fcn.00a535e0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret

Function at 0xb7a41e
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [ecx + 4]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [0xc9596c]
push ebx
xor ebx, ebx
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x18], ebx
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0xb7a48e
mov ecx, dword [ebp + 4]
mov edx, 0x19f8
push 0x9f9bd4
call fcn.00b6203c
jmp 0xb7a490
mov bl, 1
mov al, bl
pop ebx
leave
ret 8
Function at 0xb7a636
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
xor esi, esi
push edi
mov edi, esi
cmp dword [ebx + 0xec], esi
je 0xb7a6b8
mov ecx, dword [ebx + 0x2c]
xor eax, eax
shr ecx, 1
and ecx, 1
cmp dword [ebx + 0x170], esi
setne al
cmp ecx, eax
jne 0xb7a6b8
push 0x20
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0xb7a6b8
mov eax, dword [ebx + 0xec]
mov dword [edi], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0xc], eax
mov eax, dword [0xc9585c]
mov dword [edi + 4], eax
mov eax, dword [ebx + 4]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0x2c]
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x28]
mov dword [edi + 0x14], eax
mov eax, dword [ebx + 0x170]
mov dword [edi + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x1c], eax
mov dword [ebx + 0xec], esi
mov dword [ebx + 0x2c], esi
test edi, edi
je 0xb7a70e
push esi
push 0x2000
push edi
push 0xb75270
call dword [sym.imp.api_ms_win_shcore_thread_l1_1_0.dll_SHCreateThread]
test eax, eax
je 0xb7a6da
xor esi, esi
inc esi
jmp 0xb7a70e
mov eax, dword [edi]
mov dword [ebp - 4], eax
cmp dword [ebx + 0xec], esi
je 0xb7a6fe
test eax, eax
je 0xb7a704
push dword [eax + 4]
call fcn.00a4b54c
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
jmp 0xb7a704
mov dword [ebx + 0xec], eax
push 0x20
push edi
call fcn.00ab420c
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0xb7a717
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
test byte [0xc96fc0], 1
push edi
mov edi, ecx
je 0xb7a751
lea eax, [ebp - 0x21c]
mov edx, 0xa145e0
push eax
push 1
push ecx
mov ecx, 0xc933f0
call fcn.00a4d1e0
mov ecx, dword [edi + 4]
mov edx, 0xa2410c
call fcn.00bb981d
test eax, eax
jne 0xb7a822
push esi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x2d2
push dword [0xc9596c]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadStringW]
lea eax, [ebp - 0x20c]
push eax
push 0x8002
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_FindWindowW]
mov esi, eax
test esi, esi
je 0xb7a7cc
lea eax, [ebp - 0x220]
push eax
push esi
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_GetWindowThreadProcessId]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
cmp dword [ebp - 0x220], eax
jne 0xb7a7cc
push esi
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_IsWindowVisible]
test eax, eax
je 0xb7a7cc
push esi
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SetForegroundWindow]
jmp 0xb7a821
push 0x10
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xb7a821
push esi
call dword [sym.imp.api_ms_win_ntuser_rectangle_l1_1_0.dll_SetRectEmpty]
add dword [esi + 8], 0x28
add dword [esi + 0xc], 0x28
push 2
push esi
push 0
push dword [edi + 4]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_MapWindowPoints]
push 0
push 0x2008
push esi
push 0xb757f0
call dword [sym.imp.api_ms_win_shcore_thread_l1_1_0.dll_SHCreateThread]
test eax, eax
jne 0xb7a821
push 0x10
push esi
call fcn.00ab420c
pop ecx
pop ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00ab3c50
leave
ret
Function at 0xb7aaec
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
xor ecx, ecx
mov word [ebp - 0x20c], cx
test eax, eax
je 0xb7ab75
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0xb7ab75
cmp word [ebp - 0x20c], 0
je 0xb7ab64
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathGetDriveNumberW]
cmp eax, 0xffffffff
je 0xb7ab64
push eax
call dword [sym.imp.SHCORE.dll_Ordinal_174]
cmp eax, 2
je 0xb7ab53
cmp eax, 5
jne 0xb7ab64
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFileExistsW]
test eax, eax
je 0xb7ab75
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0xb7ab87
push 0
push 0x10
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetSpecialFolderPathW]
push pe_nt_image_headers32
lea eax, [ebp - 0x40c]
push eax
push 0x2d2
push dword [0xc9596c]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadStringW]
push 0x104
push 0
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_Ordinal_61]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00ab3c50
leave
ret 0x10
Function at 0xb7e069
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xb00c34
mov eax, dword fs:[0]
push eax
sub esp, 0x444
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x44c], eax
push 0x31
push 0x32
xor ebx, ebx
mov dword [ebp - 0x450], eax
push 0x9f8950
lea ecx, [ebp - 0x428]
mov dword [ebp - 0x448], ebx
mov dword [ebp - 0x414], ebx
call fcn.00a53585
mov esi, dword [ebp - 0x414]
lea ecx, [ebp - 0x448]
call fcn.00a398c6
lea eax, [ebp - 0x448]
push eax
push 0x9f89b4
push esi
call dword [sym.imp.api_ms_win_core_winrt_l1_1_0.dll_RoGetActivationFactory]
mov esi, eax
test esi, esi
jns 0xb7e109
mov ecx, dword [ebp + 4]
push esi
push 0x9fa1a0
push 0x2a
pop edx
call fcn.00aa4c55
jmp 0xb7e257
mov esi, dword [ebp - 0x448]
lea ecx, [ebp - 0x444]
mov dword [ebp - 0x444], ebx
mov eax, dword [esi]
mov edi, dword [eax + 0x18]
call fcn.00a398c6
lea eax, [ebp - 0x444]
mov ecx, edi
push eax
push esi
call dword [0xc99200]
call edi
mov esi, eax
test esi, esi
jns 0xb7e15e
push esi
push 0x9fa1a0
push 0x2d
mov ecx, dword [ebp + 4]
pop edx
call fcn.00aa4c55
lea ecx, [ebp - 0x444]
call fcn.00a398c6
jmp 0xb7e257
mov esi, dword [ebp - 0x444]
lea ecx, [ebp - 0x440]
push dword [ebp - 0x44c]
mov eax, dword [esi]
mov edi, dword [eax + 0x30]
lea eax, [ebp - 0x450]
push eax
call fcn.00a4ab34
mov ecx, edi
push dword [eax + 0x14]
push esi
call dword [0xc99200]
call edi
mov ebx, eax
test ebx, ebx
jns 0xb7e1b2
mov ecx, dword [ebp + 4]
push ebx
push 0x9fa1a0
push 0x32
pop edx
call fcn.00ab606d
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x44c], eax
cmp ebx, 0x803e0105
je 0xb7e242
push 0x34
pop ecx
mov esi, 0xa009f0
lea edi, [ebp - 0x410]
rep movsd dword es:[edi], dword [esi]
push 0x32e
lea eax, [ebp - 0x33e]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.00ab4bf6
add esp, 0xc
lea ecx, [ebp - 0x410]
mov edx, 0x200
push dword [ebp - 0x44c]
call fcn.00a4355b
mov esi, eax
test esi, esi
jns 0xb7e20f
push esi
push 0x9fa1a0
push 0x37
jmp 0xb7e145
lea eax, [ebp - 0x410]
push eax
push reloc.SHCORE.dll_Ordinal_1
call dword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegDeleteKeyW]
cmp eax, 2
je 0xb7e242
test eax, eax
je 0xb7e242
mov ecx, dword [ebp + 4]
push eax
push 0x9fa1a0
push 0x3a
pop edx
call fcn.00b667e8
mov esi, eax
jmp 0xb7e14e
lea ecx, [ebp - 0x444]
call fcn.00a398c6
test ebx, ebx
jns 0xb7e255
mov esi, ebx
jmp 0xb7e257
xor esi, esi
lea ecx, [ebp - 0x448]
call fcn.00a398c6
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00ab3c50
leave
ret
Function at 0xb7e4e6
Capabilities:
Check if file exists
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.00b7e069
mov ecx, esi
call fcn.00b7f115
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00ab4bf6
pop ecx
pop ecx
lea edx, [ebp - 0x210]
mov ecx, esi
call fcn.00b7e66d
test eax, eax
jns 0xb7e543
mov ecx, dword [ebp + 4]
push eax
push 0x9fa1a0
push 0x66
pop edx
call fcn.00ab606d
jmp 0xb7e56f
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
test eax, eax
jne 0xb7e56f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
je 0xb7e56f
mov ecx, dword [ebp + 4]
push 0x9fa1a0
push 0x69
pop edx
call fcn.00b6203c
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00ab3c50
leave
ret

Function at 0xb7e66d
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 8], eax
cmp word [0xc972e8], 0
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
jne 0xb7e6c8
push 0xc972e8
push 0xa170c8
xor eax, eax
push eax
push eax
push 0x801c
push eax
call dword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetFolderPathAndSubDirW]
mov esi, eax
test esi, esi
jns 0xb7e6c8
push esi
push 0x9fa1a0
push 0x54
mov ecx, dword [ebp + 4]
pop edx
call fcn.00aa4c55
mov eax, esi
jmp 0xb7e719
push ebx
push 0xa170b8
mov ebx, 0x104
lea eax, [ebp - 0x214]
push ebx
push eax
call fcn.00a60c0c
mov esi, eax
add esp, 0x10
test esi, esi
jns 0xb7e6f3
push esi
push 0x9fa1a0
push 0x58
jmp 0xb7e6bb
lea eax, [ebp - 0x214]
push eax
push 0xc972e8
push ebx
push edi
call dword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchCombine]
mov esi, eax
test esi, esi
jns 0xb7e717
push esi
push 0x9fa1a0
push 0x5a
jmp 0xb7e6bb
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret 4

Function at 0xb818d9
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ecx + 0x18]
test esi, esi
je 0xb8197d
push 0x4e
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.00ab4bf6
add esp, 0xc
lea eax, [ebp - 0x58]
mov ecx, esi
push 0x27
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.00a4f267
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_StringFromGUID2]
test eax, eax
jle 0xb8197d
push 0x3c
pop esi
push esi
lea eax, [ebp - 0xa4]
push 0
push eax
call fcn.00ab4bf6
and dword [ebp - 0x9c], 0
lea eax, [ebp - 0xa4]
add esp, 0xc
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xa0], pe_nt_image_headers32
mov dword [ebp - 0x98], 0x9f96d4
mov dword [ebp - 0x94], 0xa171cc
push eax
mov dword [ebp - 0x88], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00ab3c50
leave
ret