joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406be0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x45bed8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x473ff0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor edi, edi
xor eax, eax
push 0xffffffffffffffff
mov word [esp + 0x14], ax
mov eax, dword [esp + 0x3c]
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
call fcn.00401640
mov eax, ebx
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x406c36
sub eax, edx
sar eax, 1
push eax
push ebx
lea eax, [esp + 0x14]
call fcn.004027b0
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0xffffffffffffffff
mov word [esi + 4], cx
push edi
mov ecx, esi
call fcn.00401640
cmp dword [esp + 0x24], 8
jb 0x406c7e
mov edx, dword [esp + 0x10]
push edx
call fcn.00443850
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret

Function at 0x406cb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45b80b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x473ff0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.DuiLib::WindowImplBase.4.0
mov dword [esi + 0x20], vtable.DuiLib::WindowImplBase.3.0
mov dword [esi + 0x30], vtable.DuiLib::WindowImplBase.2.0
mov dword [esi + 0x34], vtable.DuiLib::WindowImplBase.1.0
mov dword [esi + 0x38], vtable.DuiLib::WindowImplBase.0
lea ecx, [esi + 0x3c]
mov dword [esp + 0x14], 0
call fcn.0040d675
lea ecx, [esi + 0x24]
mov dword [esp + 0x14], 0xffffffff
call fcn.004101c7
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x406dd0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x45b86b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x473ff0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.0041041b
push 0x53
lea ecx, [esi + 0x24]
mov dword [esi + 0x20], vtable.DuiLib::CNotifyPump.0
call fcn.0040faf1
xor edi, edi
mov dword [esp + 0x18], edi
mov dword [esi + 0x30], vtable.DuiLib::INotifyUI.0
mov dword [esi + 0x34], vtable.DuiLib::IMessageFilterUI.0
mov dword [esi + 0x38], vtable.DuiLib::IDialogBuilderCallback.0
lea ecx, [esi + 0x3c]
mov dword [esi], vtable.DuiLib::WindowImplBase.4.0
mov dword [esi + 0x20], vtable.DuiLib::WindowImplBase.3.0
mov dword [esi + 0x30], vtable.DuiLib::WindowImplBase.2.0
mov dword [esi + 0x34], vtable.DuiLib::WindowImplBase.1.0
mov dword [esi + 0x38], vtable.DuiLib::WindowImplBase.0
call fcn.0040ce1c
mov dword [esi + 0x3d4], edi
mov dword [esi + 0x3d8], edi
mov dword [esi + 0x3dc], edi
mov dword [esi + 0x3e0], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x406e80
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x45be1b
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x473ff0]
xor eax, esp
mov dword [esp + 0x124], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x473ff0]
xor eax, esp
push eax
lea eax, [esp + 0x13c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14c]
mov esi, dword [esp + 0x150]
mov edi, ecx
mov ebx, edx
push 0x469e94
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], esi
call fcn.0044399e
mov ebp, eax
xor eax, eax
add esp, 8
mov dword [esp + 0x14], ebp
cmp ebp, eax
jne 0x406f31
cmp ebx, eax
je 0x406f2a
lea edi, [esp + 0x2c]
call fcn.00407520
push 0xffffffffffffffff
push 0
mov ecx, ebx
mov dword [esp + 0x14c], 0
call fcn.00401640
cmp dword [esp + 0x44], 8
jb 0x406f2a
mov ecx, dword [esp + 0x30]
push ecx
call fcn.00443850
add esp, 4
xor al, al
jmp 0x407068
cmp esi, eax
je 0x406f3d
mov edx, dword [esi]
mov dword [esp + 0x18], edx
jmp 0x406f41
mov dword [esp + 0x18], eax
xor ecx, ecx
mov dword [esp + 0x4a], eax
mov dword [esp + 0x4e], eax
mov dword [esp + 0x52], eax
mov dword [esp + 0x56], eax
mov dword [esp + 0x5a], eax
mov dword [esp + 0x5e], eax
mov dword [esp + 0x62], eax
mov dword [esp + 0x66], eax
mov dword [esp + 0x6a], eax
mov word [esp + 0x6e], ax
or eax, 0xffffffff
xor ebx, ebx
mov esi, edi
mov word [esp + 0x48], cx
call fcn.00401290
push 2
push ebx
push ebp
call fcn.00444687
push ebp
call fcn.004448a9
push ebx
push ebx
push ebp
mov edi, eax
call fcn.00444687
add esp, 0x1c
test edi, edi
je 0x40700e
push edi
call fcn.0040b6cb
mov edx, dword [esp + 0x18]
push edx
push 1
mov ebp, eax
push edi
push ebp
call fcn.00444bb7
push edi
mov edx, ebp
xor ecx, ecx
call fcn.004072f0
mov ebx, eax
xor ecx, ecx
lea eax, [ebx + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040b6cb
mov esi, eax
push edi
mov edx, ebp
mov ecx, esi
mov dword [esp + 0x48], esi
call fcn.004072f0
add esp, 0x20
mov eax, esi
mov esi, dword [esp + 0x24]
push ebx
call fcn.004011a0
mov eax, dword [esp + 0x28]
push eax
call fcn.00443edc
push ebp
call fcn.00443edc
mov ebp, dword [esp + 0x1c]
add esp, 8
push ebx
push edi
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x7c]
push str._s_d_bytes_to__d_wide_chars
push edx
call fcn.00444bd4
mov esi, dword [esp + 0x30]
add esp, 0x14
test esi, esi
je 0x40704f
lea eax, [esp + 0x70]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407036
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x74]
call fcn.004011a0
push ebp
call fcn.00443c10
mov eax, dword [esp + 0x24]
add esp, 4
test eax, eax
je 0x407066
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
mov al, 1
mov ecx, dword [esp + 0x13c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.004437f0
add esp, 0x134
ret
Function at 0x407520
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x45bdf1
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x473ff0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 0xc], 0
lea ebx, [edi + 4]
xor eax, eax
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], 0
mov dword [esp + 0x10], edi
mov word [ebx], ax
mov dword [esp + 0x38], eax
mov dword [esp + 0xc], 1
call fcn.00445212
mov ecx, dword [eax]
push ecx
call fcn.0044515d
mov ecx, eax
add esp, 4
lea esi, [ecx + 2]
jmp 0x407590
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x407590
sub ecx, esi
sar ecx, 1
push ecx
mov esi, edi
call fcn.004011a0
xor esi, esi
cmp esi, dword [edi + 0x14]
jge 0x407638
jbe 0x4075b9
call fcn.004441fc
cmp dword [edi + 0x18], 8
jb 0x4075c3
mov eax, dword [ebx]
jmp 0x4075c5
mov eax, ebx
cmp word [eax + esi*2], 0xd
je 0x407603
cmp esi, dword [edi + 0x14]
jbe 0x4075d6
call fcn.004441fc
cmp dword [edi + 0x18], 8
jb 0x4075e0
mov eax, dword [ebx]
jmp 0x4075e2
mov eax, ebx
cmp word [eax + esi*2], 0xa
je 0x407603
inc esi
cmp esi, dword [edi + 0x14]
jl 0x4075b2
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret
mov ecx, esi
push edi
xor edx, edx
lea esi, [esp + 0x18]
call fcn.004025a0
push 0xffffffffffffffff
push 0
mov ecx, edi
mov dword [esp + 0x40], 1
call fcn.00401640
cmp dword [esp + 0x2c], 8
jb 0x407638
mov edx, dword [esp + 0x18]
push edx
call fcn.00443850
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret

Function at 0x408260
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45bba8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x473ff0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x473ff0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
xor ebx, ebx
cmp ecx, eax
mov dword [esp + 0xc], ebx
jle 0x4082be
xor eax, eax
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
mov word [edi + 4], ax
push ebx
mov eax, 0x4694dc
mov esi, edi
call fcn.004011a0
jmp 0x40831a
mov edx, dword [edx + 0xc]
sub eax, ecx
inc eax
lea ecx, [edx + ecx*2]
xor edx, edx
push eax
mov eax, ecx
lea esi, [esp + 0x14]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], dx
call fcn.004011a0
mov dword [esp + 0x38], ebx
xor eax, eax
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
push 0xffffffffffffffff
mov word [edi + 4], ax
push ebx
mov eax, esi
mov ecx, edi
call fcn.00401640
cmp dword [esp + 0x28], 8
jb 0x40831a
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00443850
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004437f0
add esp, 0x30
ret
Function at 0x40a160
Capabilities:
Create thread
Resume thread

Disassembly:
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x40a17d
push eax
call edi
mov dword [esi + 0x14], ebx
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x40a18a
push eax
call edi
mov dword [esi + 0x18], ebx
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x2c]
mov dword [esi + 0x28], eax
mov eax, dword [esp + 0x30]
lea edi, [esi + 0x1c]
mov dword [esi + 0x20], ebx
mov dword [edi], ebx
mov dword [esi + 0x30], ecx
cmp eax, ebx
jne 0x40a1ea
xor edx, edx
push 0xb
mov eax, 0x46a36c
lea esi, [esp + 0x10]
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], dx
call fcn.004011a0
cmp dword [esp + 0x24], 8
jb 0x40a1df
mov eax, dword [esp + 0x10]
push eax
call fcn.00443850
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x1c
ret 0xc
cmp dword [esi], 1
mov dword [esi + 0x38], eax
jne 0x40a21a
lea ecx, [esp + 0xc]
cmp dword [esi + 8], ebx
je 0x40a202
mov eax, 0x46a384
jmp 0x40a256
mov eax, 0x46a3a0
call fcn.00401160
cmp dword [esp + 0x24], 8
jb 0x40a26f
mov edx, dword [esp + 0x10]
push edx
jmp 0x40a267
push edi
push 4
push esi
push 0x40a480
push ebx
push ebx
mov dword [edi], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xf
push eax
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp dword [edi], ebx
je 0x40a26f
mov dword [esi], 1
mov eax, 0x46a3b8
lea ecx, [esp + 0xc]
call fcn.00401160
cmp dword [esp + 0x24], 8
jb 0x40a26f
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00443850
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x1c
ret 0xc

Function at 0x40a2a0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x1c
push edi
mov edi, ecx
cmp dword [edi], 0
mov ecx, dword [esp + 0x28]
mov dword [edi + 0x3c], eax
mov dword [edi + 0x2c], ecx
je 0x40a32d
push esi
lea esi, [edi + 0x20]
push esi
push 0
push edi
push 0x40a4f0
push 0
push 0
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [esi], 0
mov dword [edi + 0x18], eax
je 0x40a320
xor edx, edx
push 0x16
mov eax, str.Pbk_ah
lea esi, [esp + 0xc]
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], 0
mov word [esp + 0x10], dx
call fcn.004011a0
cmp dword [esp + 0x20], 8
jb 0x40a319
mov eax, dword [esp + 0xc]
push eax
call fcn.00443850
add esp, 4
mov dword [edi + 8], 1
pop esi
mov eax, 1
pop edi
add esp, 0x1c
ret 8
xor eax, eax
pop edi
add esp, 0x1c
ret 8
Function at 0x40a920
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x45bfe8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x473ff0]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov edi, ecx
mov ebp, dword [esp + 0x60]
cmp dword [ebp + 0x18], 8
lea esi, [ebp + 4]
jb 0x40a95a
mov eax, dword [esi]
jmp 0x40a95c
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ebx, ebx
cmp dword [edi + 0x4c], ebx
jne 0x40a9b9
xor eax, eax
mov word [esp + 0x1c], ax
push 0xf
mov eax, 0x46a464
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebx
call fcn.004011a0
push 0xffffffffffffffff
push ebx
lea ecx, [edi + 0x70]
mov eax, esi
mov dword [esp + 0x60], ebx
call fcn.00401640
cmp dword [esp + 0x30], 8
jb 0x40a9b2
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00443850
add esp, 4
xor al, al
jmp 0x40ab11
cmp dword [edi + 0x90], ebx
jne 0x40a9cc
mov ecx, edi
call sym.Install.exe_protected:_bool___thiscall_CShortcut::InitUrlInstance_void_
test al, al
je 0x40a9b2
cmp dword [edi + 0x50], 8
jb 0x40a9d7
mov ecx, dword [edi + 0x3c]
jmp 0x40a9da
lea ecx, [edi + 0x3c]
mov eax, dword [edi + 0x90]
mov edx, dword [eax]
push ebx
push ecx
push eax
mov eax, dword [edx + 0xc]
call eax
cmp eax, ebx
jge 0x40aa41
xor ecx, ecx
push 0xc
mov eax, str.SetURL
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], cx
call fcn.004011a0
push 0xffffffffffffffff
push ebx
lea ecx, [edi + 0x70]
mov eax, esi
mov dword [esp + 0x60], 1
call fcn.00401640
cmp dword [esp + 0x30], 8
jb 0x40a9b2
mov edx, dword [esp + 0x1c]
push edx
call fcn.00443850
add esp, 4
xor al, al
jmp 0x40ab11
mov dword [esp + 0x60], ebx
cmp dword [edi + 0x68], ebx
je 0x40aa8d
mov eax, dword [edi + 0x90]
mov ecx, dword [eax]
lea edx, [esp + 0x60]
push edx
push 0x468f9c
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jl 0x40aa8d
cmp dword [edi + 0x6c], 8
jb 0x40aa70
mov ecx, dword [edi + 0x58]
jmp 0x40aa73
lea ecx, [edi + 0x58]
mov eax, dword [esp + 0x60]
mov edx, dword [eax]
push ebx
push ecx
push eax
mov eax, dword [edx + 0x44]
call eax
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [edi + 0x90]
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], ebx
mov ecx, dword [eax]
push 0x468fec
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jl 0x40a9b2
cmp dword [ebp + 0x18], 8
jb 0x40aaba
mov ecx, dword [esi]
jmp 0x40aabc
mov ecx, esi
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
push 1
push ecx
push eax
mov eax, dword [edx + 0x18]
call eax
mov esi, eax
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
cmp esi, ebx
jge 0x40ab0f
mov eax, 0x46a4a0
lea ecx, [esp + 0x34]
call fcn.00401160
push 0xffffffffffffffff
push ebx
lea ecx, [edi + 0x70]
lea eax, [esp + 0x3c]
mov dword [esp + 0x60], 2
call fcn.00401640
lea esi, [esp + 0x34]
call fcn.00401730
xor al, al
jmp 0x40ab11
mov al, 1
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret 4
Function at 0x40ada0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x45c056
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x473ff0]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push esi
push edi
mov eax, dword [0x473ff0]
xor eax, esp
push eax
lea eax, [esp + 0x25c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x26c]
xor eax, eax
mov edi, ecx
push 0x208
push eax
lea ecx, [esp + 0x56]
push ecx
mov dword [esp + 0x1c], edi
mov word [esp + 0x58], ax
call fcn.00445b20
mov esi, dword [esp + 0x27c]
add esp, 0xc
push 0
push esi
lea edx, [esp + 0x54]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x40ae71
mov dword [esp + 0x28], eax
mov word [esp + 0x18], ax
push 0xa
mov eax, 0x46a4e8
lea esi, [esp + 0x18]
mov dword [esp + 0x30], 7
call fcn.004011a0
push 0xffffffffffffffff
push 0
lea ecx, [edi + 0x70]
mov eax, esi
mov dword [esp + 0x26c], 0
call fcn.00401640
cmp dword [esp + 0x2c], 8
jb 0x40ae6a
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00443850
add esp, 4
xor al, al
jmp 0x40af9c
cmp esi, 0x1a
jne 0x40ae98
lea edi, [esp + 0x4c]
add edi, 0xfffffffe
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40ae80
mov ecx, 0x15
mov esi, str.MicrosoftInternet_ExplorerQuick_Launch
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x4c]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40aea0
cmp dword [ebx + 0x18], 8
mov edx, dword [0x469494]
mov dword [edi], edx
jb 0x40aebf
mov eax, dword [ebx + 4]
jmp 0x40aec2
lea eax, [ebx + 4]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40aec4
lea edi, [esp + 0x4c]
sub eax, edx
add edi, 0xfffffffe
jmp 0x40aee0
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x40aee0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x4c]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x40af03
mov ecx, dword [str..lnk]
mov edx, dword [str.PZtW]
mov dword [eax], ecx
mov cx, word [0x469c50]
mov dword [eax + 4], edx
xor edx, edx
mov word [eax + 8], cx
lea eax, [esp + 0x4c]
mov word [esp + 0x34], dx
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40af50
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x50]
lea esi, [esp + 0x34]
call fcn.004011a0
mov ecx, dword [esp + 0x10]
mov eax, esi
push eax
mov dword [esp + 0x268], 1
call sym.Install.exe_public:_bool___thiscall_CShortcut::CreateFileLink_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__
cmp dword [esp + 0x48], 8
mov bl, al
jb 0x40af9a
mov ecx, dword [esp + 0x34]
push ecx
call fcn.00443850
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x25c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.004437f0
add esp, 0x258
ret 8
Function at 0x40afd0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x45c056
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x473ff0]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push esi
push edi
mov eax, dword [0x473ff0]
xor eax, esp
push eax
lea eax, [esp + 0x25c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x26c]
xor eax, eax
mov edi, ecx
push 0x208
push eax
lea ecx, [esp + 0x56]
push ecx
mov dword [esp + 0x1c], edi
mov word [esp + 0x58], ax
call fcn.00445b20
mov esi, dword [esp + 0x27c]
add esp, 0xc
push 0
push esi
lea edx, [esp + 0x54]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x40b0a1
mov dword [esp + 0x28], eax
mov word [esp + 0x18], ax
push 0xa
mov eax, 0x46a4e8
lea esi, [esp + 0x18]
mov dword [esp + 0x30], 7
call fcn.004011a0
push 0xffffffffffffffff
push 0
lea ecx, [edi + 0x70]
mov eax, esi
mov dword [esp + 0x26c], 0
call fcn.00401640
cmp dword [esp + 0x2c], 8
jb 0x40b09a
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00443850
add esp, 4
xor al, al
jmp 0x40b1cc
cmp esi, 0x1a
jne 0x40b0c8
lea edi, [esp + 0x4c]
add edi, 0xfffffffe
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40b0b0
mov ecx, 0x15
mov esi, str.MicrosoftInternet_ExplorerQuick_Launch
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x4c]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40b0d0
cmp dword [ebx + 0x18], 8
mov edx, dword [0x469494]
mov dword [edi], edx
jb 0x40b0ef
mov eax, dword [ebx + 4]
jmp 0x40b0f2
lea eax, [ebx + 4]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b0f4
lea edi, [esp + 0x4c]
sub eax, edx
add edi, 0xfffffffe
jmp 0x40b110
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x40b110
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x4c]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x40b133
mov ecx, dword [str..url]
mov edx, dword [0x46a558]
mov dword [eax], ecx
mov cx, word [0x46a55c]
mov dword [eax + 4], edx
xor edx, edx
mov word [eax + 8], cx
lea eax, [esp + 0x4c]
mov word [esp + 0x34], dx
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b180
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x50]
lea esi, [esp + 0x34]
call fcn.004011a0
mov ecx, dword [esp + 0x10]
mov eax, esi
push eax
mov dword [esp + 0x268], 1
call sym.Install.exe_public:_bool___thiscall_CShortcut::CreateUrlLink_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__
cmp dword [esp + 0x48], 8
mov bl, al
jb 0x40b1ca
mov ecx, dword [esp + 0x34]
push ecx
call fcn.00443850
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x25c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.004437f0
add esp, 0x258
ret 8
Function at 0x40b420
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x473ff0]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
mov ebx, dword [esp + 0x218]
push esi
push edi
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0x16]
push ecx
mov word [esp + 0x18], ax
call fcn.00445b20
mov esi, dword [esp + 0x230]
add esp, 0xc
push 0
push esi
lea edx, [esp + 0x14]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp esi, 0x1a
jne 0x40b498
lea edi, [esp + 0xc]
add edi, 0xfffffffe
jmp 0x40b480
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40b480
mov ecx, 0x15
mov esi, str.MicrosoftInternet_ExplorerQuick_Launch
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0xc]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40b4a0
cmp dword [ebx + 0x18], 8
mov eax, dword [0x469494]
mov dword [edi], eax
jb 0x40b4be
mov eax, dword [ebx + 4]
jmp 0x40b4c1
lea eax, [ebx + 4]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b4c3
lea edi, [esp + 0xc]
sub eax, edx
add edi, 0xfffffffe
jmp 0x40b4e0
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x40b4e0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
lea eax, [esp + 8]
pop esi
add eax, 0xfffffffe
cmp dword [esp + 0x220], 0
pop ebx
jne 0x40b540
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x40b510
mov ecx, dword [str..url]
mov edx, dword [0x46a558]
mov dword [eax], ecx
mov cx, word [0x46a55c]
mov dword [eax + 4], edx
mov word [eax + 8], cx
jmp 0x40b568
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x40b540
mov edx, dword [str..lnk]
mov ecx, dword [str.PZtW]
mov dword [eax], edx
mov dx, word [0x469c50]
mov dword [eax + 4], ecx
mov word [eax + 8], dx
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x20c]
xor ecx, esp
mov al, 1
call fcn.004437f0
add esp, 0x210
ret

Function at 0x40b6d6
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x11
xor edi, edi
call esi
test ax, ax
jge 0x40b6ec
push 8
pop edi
push 2
call esi
test ax, ax
jge 0x40b6f8
or edi, 1
push 1
call esi
test ax, ax
jge 0x40b704
or edi, 2
push 0x10
call esi
test ax, ax
jge 0x40b710
or edi, 4
push 0x12
call esi
test ax, ax
jge 0x40b71c
or edi, 0x20
mov eax, edi
pop edi
pop esi
ret