joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414548
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
je 0x4145dc
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4145dc
mov edi, dword [esi + 0x1c]
test edi, edi
je 0x4145dc
mov eax, dword [esp + 0x1c]
lea ebp, [esi + 0x14]
dec eax
add eax, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x10]
mov dword [esp + 0x1c], eax
lea edx, [eax + ecx]
cmp dword [esi + 0x18], ebx
je 0x414591
mov ecx, dword [ebp]
cmp eax, ecx
je 0x414591
mov eax, dword [esp + 0x1c]
jmp 0x4145d2
push ebx
push ebp
push dword [esi + 0xc]
mov dword [esi + 0x10], ebx
push dword [esi + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x4145dc
mov ecx, dword [ebp]
cmp ecx, 1
jb 0x414621
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x10]
jmp 0x4145d2
cmp edi, dword [esp + 0x10]
jae 0x41460e
mov al, byte [edx]
cmp al, 0xa
je 0x4145e6
mov byte [edi], al
inc edi
mov eax, dword [esi + 0x10]
inc edx
inc eax
mov dword [esi + 0x10], eax
mov ecx, dword [ebp]
cmp eax, ecx
jb 0x4145b8
mov dword [esp + 0x1c], eax
jbe 0x41457f
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
cmp edi, dword [esi + 0x1c]
jbe 0x4145f4
lea eax, [edi - 1]
cmp byte [eax], 0xd
cmove edi, eax
mov ecx, dword [esp + 0x18]
mov byte [edi], bl
push dword [esi + 0x1c]
call fcn.00401bff
mov eax, dword [esi + 0x18]
inc dword [esi + 0x10]
inc eax
mov dword [esi + 0x18], eax
jmp 0x4145de
mov ecx, dword [esp + 0x18]
mov byte [edi], bl
push dword [esi + 0x1c]
call fcn.00401bff
mov eax, dword [esi + 0x18]
jmp 0x4145de
mov ecx, dword [esp + 0x18]
mov byte [edi], bl
push dword [esi + 0x1c]
call fcn.00401bff
cmp edi, dword [esi + 0x1c]
je 0x414637
mov ebx, dword [esi + 0x18]
mov eax, ebx
jmp 0x4145de

Function at 0x4146b1
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
call fcn.00414771
mov eax, dword [esi + 8]
test eax, eax
jne 0x4146e7
cmp dword [esi + 0xc], eax
je 0x4146dc
push 0x44d836
push dword [esi + 0xc]
call fcn.004166c6
pop ecx
pop ecx
mov dword [esi + 8], eax
test eax, eax
jne 0x4146e7
xor al, al
jmp 0x41476a
push ebx
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 3
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [esi], eax
test eax, eax
je 0x414765
cmp eax, 0xffffffff
je 0x414765
push edi
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
push ebx
lea edi, [esi + 0x14]
mov dword [esi + 4], eax
push edi
push 2
lea eax, [ebp - 4]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x41474b
cmp dword [edi], 2
jne 0x41474b
cmp byte [ebp - 4], 0xff
jne 0x41474b
cmp byte [ebp - 3], 0xfe
jne 0x41474b
mov byte [esi + 0x24], 1
jmp 0x414760
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], ebx
cmp dword [esi], ebx
je 0x414760
push ebx
push ebx
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov al, 1
pop edi
jmp 0x414769
mov dword [esi], ebx
xor al, al
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x414a9a
Capabilities:
Get hostname

Disassembly:
sub esp, 0x354
push ebx
push ebp
push esi
push edi
push 0x208
xor esi, esi
mov dword [esp + 0x1c], ecx
lea eax, [esp + 0x15c]
push esi
push eax
call fcn.004183a0
mov eax, dword [0x4ab6b0]
add esp, 0xc
mov ebp, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edi, 0x104
mov ebx, dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test eax, eax
jne 0x414af6
push str.Ws2_32.dll
call ebx
test eax, eax
je 0x414b05
push str.GetHostNameW
push eax
call ebp
mov dword [0x4ab6b0], eax
test eax, eax
je 0x414b05
push edi
lea ecx, [esp + 0x15c]
push ecx
call eax
test eax, eax
je 0x414b29
push edi
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x414b29
lea eax, [esp + 0x50]
mov edx, edi
push eax
lea ecx, [esp + 0x15c]
call fcn.00401b97
pop ecx
cmp word [esp + 0x158], si
je 0x414bc3
push 8
xor eax, eax
mov dword [esp + 0x14], esi
pop ecx
lea edi, [esp + 0x30]
rep stosd dword es:[edi], eax
mov eax, dword [0x4ab6b4]
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], 1
mov dword [esp + 0x3c], 6
test eax, eax
jne 0x414b7f
push str.Ws2_32.dll
call ebx
test eax, eax
je 0x414bd5
push str.GetAddrInfoW
push eax
call ebp
mov dword [0x4ab6b4], eax
test eax, eax
je 0x414bd5
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x34]
push ecx
push esi
lea ecx, [esp + 0x164]
push ecx
call eax
test eax, eax
jne 0x414bd5
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x414bd5
mov edi, dword [esp + 0x18]
cmp dword [ecx + 4], 2
jne 0x414bbc
mov eax, dword [ecx + 0x18]
mov edx, dword [eax + 4]
cmp edx, 0xffffffff
je 0x414bbc
mov eax, esi
inc esi
cmp edi, eax
je 0x414bd1
mov ecx, dword [ecx + 0x1c]
test ecx, ecx
jne 0x414ba4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x354
ret
mov eax, edx
jmp 0x414bc6
push 0x104
lea eax, [esp + 0x54]
push esi
push eax
call fcn.004183a0
lea eax, [esp + 0x164]
mov dword [esp + 0x20], esi
push eax
lea ecx, [esp + 0x60]
call fcn.00409784
mov eax, dword [0x4ab6b8]
add esp, 0x10
test eax, eax
jne 0x414c22
push str.Ws2_32.dll
call ebx
test eax, eax
je 0x414bc3
push str.gethostbyname
push eax
call ebp
mov dword [0x4ab6b8], eax
test eax, eax
je 0x414bc3
lea ecx, [esp + 0x50]
push ecx
call eax
mov ecx, eax
mov dword [esp + 0x1c], ecx
test ecx, ecx
je 0x414bc3
mov ebx, dword [ecx + 0xc]
mov ebp, esi
cmp dword [ebx], esi
je 0x414bc3
cmp ebp, 8
jge 0x414bc3
xor eax, eax
lea edi, [esp + 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
movsx eax, word [ecx + 0xa]
push eax
push dword [ebx]
lea eax, [esp + 0x2c]
push eax
call fcn.004309f0
add esp, 0xc
cmp dword [esp + 0x24], 0xffffffff
je 0x414c77
mov edi, dword [esp + 0x14]
mov eax, edi
inc edi
mov dword [esp + 0x14], edi
cmp dword [esp + 0x18], eax
je 0x414c89
add ebx, 4
inc ebp
cmp dword [ebx], esi
je 0x414bc3
mov ecx, dword [esp + 0x1c]
jmp 0x414c3c
mov eax, dword [esp + 0x24]
jmp 0x414bc6
Function at 0x418a57
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x44da00
push str.FlsAlloc
push 0
call fcn.004189d0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x418a89
push dword [ebp + 8]
mov ecx, esi
call fcn.00416e2c
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.DLL_TlsAlloc]

Function at 0x418acb
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsGetValue
push 0x44da24
push str.FlsGetValue
push 2
call fcn.004189d0
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x418afc
mov ecx, esi
call fcn.00416e2c
call esi
jmp 0x418b02
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x418b05
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsSetValue
push 0x44da38
push str.FlsSetValue
push 3
call fcn.004189d0
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x418b39
mov ecx, esi
call fcn.00416e2c
call esi
jmp 0x418b3f
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
pop esi
pop ebp
ret

Function at 0x42abf1
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042a8b1
Function at 0x436c49
Capabilities:
Create process on windows
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
lea eax, [ebp - 0x244]
push ebx
push edi
mov ebx, 0x208
xor edi, edi
push ebx
push edi
push eax
call fcn.004183a0
add esp, 0xc
lea eax, [ebp - 0x244]
push eax
push edi
push edi
push 0x26
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [ebp - 0x244]
call fcn.00402221
test al, al
jne 0x436d00
call fcn.00401e67
test al, al
je 0x436d00
call fcn.00401e08
test al, al
jne 0x436d00
push 0x3c
lea eax, [ebp - 0x3c]
push edi
push eax
call fcn.004183a0
push ebx
lea eax, [ebp - 0x44c]
push edi
push eax
call fcn.004183a0
add esp, 0x18
mov dword [ebp - 0x3c], 0x3c
lea eax, [ebp - 0x44c]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0x45ad90
push 0x103
push eax
push edi
mov dword [ebp - 0x30], 0x45be50
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x436d00
xor al, al
jmp 0x436d02
mov al, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x438666
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, ecx
call fcn.0043862c
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov dword [esi + 0x118], eax
cmp eax, 0x390
jae 0x438694
and dword [esi + 0x118], 0
xor al, al
jmp 0x4386d4
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov dword [esi + 0x110], eax
test eax, eax
je 0x438689
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [esi + 0x114], eax
test eax, eax
jne 0x4386d2
push dword [esi + 0x110]
call dword [sym.imp.KERNEL32.DLL_FreeResource]
and dword [esi + 0x110], 0
jmp 0x438689
mov al, 1
pop esi
ret 8

Function at 0x43939c
Capabilities:
Identify system language via api

Disassembly:
push ebx
push ebp
push esi
or ebx, 0xffffffff
cmp dword [esp + 0x10], 0
push edi
je 0x43940a
push 0x439101
push dword [esp + 0x18]
mov ecx, 0x4ab3f0
call fcn.00411276
mov ecx, eax
test ecx, ecx
je 0x43940a
mov edx, dword [0x4ab3f4]
mov edi, dword [ecx]
test edx, edx
je 0x439400
mov esi, dword [0x4ab400]
test esi, esi
je 0x439400
cmp ecx, edx
jb 0x439400
mov eax, esi
imul eax, dword [0x4ab3f8]
add eax, edx
cmp ecx, eax
jae 0x439400
sub ecx, edx
push esi
push ecx
call fcn.00425b64
test edx, edx
mov esi, eax
pop ecx
pop ecx
cmovne esi, ebx
jmp 0x439402
mov esi, ebx
test edi, edi
jne 0x4394c1
call dword [sym.imp.KERNEL32.DLL_GetUserDefaultUILanguage]
mov ecx, dword [0x4ab3f8]
xor esi, esi
movzx edx, ax
test ecx, ecx
je 0x439458
mov ebx, dword [0x4ab400]
mov ebp, dword [0x4ab3f4]
mov eax, ebx
imul eax, esi
cmp dword [eax + ebp], 0
je 0x43944a
test edx, edx
je 0x43944a
mov eax, ebx
imul eax, esi
mov edi, dword [eax + ebp]
cmp dword [edi + 0x104], edx
je 0x439451
inc esi
cmp esi, ecx
jb 0x43942b
jmp 0x439455
test edi, edi
jne 0x4394be
or ebx, 0xffffffff
push 0x439101
push 0x45f6a4
mov ecx, 0x4ab3f0
call fcn.00411276
mov ecx, eax
test ecx, ecx
je 0x4394b5
mov edx, dword [0x4ab3f4]
mov edi, dword [ecx]
test edx, edx
je 0x4394af
mov esi, dword [0x4ab400]
test esi, esi
je 0x4394af
cmp ecx, edx
jb 0x4394af
mov eax, esi
imul eax, dword [0x4ab3f8]
add eax, edx
cmp ecx, eax
jae 0x4394af
sub ecx, edx
push esi
push ecx
call fcn.00425b64
test edx, edx
mov esi, eax
pop ecx
pop ecx
cmovne esi, ebx
jmp 0x4394b1
mov esi, ebx
test edi, edi
jne 0x4394c1
xor al, al
pop edi
pop esi
pop ebp
pop ebx
ret 4
or ebx, 0xffffffff
mov ecx, edi
call fcn.00438a02
test al, al
jne 0x439527
push 0x439101
push 0x45f6a4
mov ecx, 0x4ab3f0
call fcn.00411276
mov ecx, eax
test ecx, ecx
je 0x439525
mov edx, dword [0x4ab3f4]
test edx, edx
je 0x439521
mov esi, dword [0x4ab400]
test esi, esi
je 0x439521
cmp ecx, edx
jb 0x439521
mov eax, esi
imul eax, dword [0x4ab3f8]
add eax, edx
cmp ecx, eax
jae 0x439521
sub ecx, edx
push esi
push ecx
call fcn.00425b64
pop ecx
pop ecx
mov esi, eax
test edx, edx
cmovne esi, ebx
jmp 0x439527
mov esi, ebx
jmp 0x439527
xor esi, esi
mov dword [0x4ab408], esi
mov al, 1
jmp 0x4394b7
Function at 0x439868
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Import public key
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 0
push esi
push edi
mov esi, ecx
je 0x4398d7
cmp dword [ebp + 0xc], 0
je 0x4398d7
cmp dword [ebp + 0x10], 0
je 0x4398d7
cmp dword [ebp + 0x14], 0
je 0x4398d7
mov eax, dword [esi]
test eax, eax
je 0x4398d7
xor edi, edi
cmp dword [eax + 0xc], edi
je 0x4398d7
push 0xf0000000
push 1
push edi
push edi
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4398d7
lea eax, [ebp - 8]
push eax
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
add eax, 0x38
push eax
push 0x10001
push dword [ebp - 4]
call dword [sym.imp.CRYPT32.dll_CryptImportPublicKeyInfo]
test eax, eax
jne 0x4398e1
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push 0x8004
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x439904
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x4398cd
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x43992c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x4398cd
push edi
push edi
push dword [ebp - 8]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptVerifySignatureW]
push dword [ebp - 8]
test eax, eax
je 0x43991b
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, 1
jmp 0x4398d9

Function at 0x439d65
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x439d99
xor edx, edx
test edi, edi
je 0x439d99
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov bl, dl
mov cl, byte [edx + esi]
mov eax, edx
and eax, 0xf
mov al, byte [ebp + eax*4]
add al, bl
mov bl, cl
xor al, cl
mov byte [edx + esi], al
inc edx
cmp edx, edi
jb 0x439d7d
pop ebp
pop ebx
pop edi
pop esi
ret

Function at 0x43a73a
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x43a766
xor ecx, ecx
test edx, edx
je 0x43a766
push ebx
push edi
mov edi, dword [esp + 0x10]
mov bl, cl
mov eax, ecx
and eax, 0xf
mov al, byte [edi + eax*4]
add al, bl
xor byte [ecx + esi], al
mov bl, byte [ecx + esi]
inc ecx
cmp ecx, edx
jb 0x43a74f
pop edi
pop ebx
pop esi
ret
Function at 0x43a768
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x43a7a9
cmp dword [ebp + 0xc], 0
je 0x43a7a9
test esi, esi
je 0x43a7b4
xor ecx, ecx
test edi, edi
je 0x43a7b4
mov byte [ebp + 0xb], cl
xor edx, edx
mov eax, ecx
div dword [ebp + 0xc]
mov al, byte [edx + ebx]
add al, byte [ebp + 0xb]
xor byte [ecx + esi], al
mov al, byte [ecx + esi]
inc ecx
mov byte [ebp + 0xb], al
cmp ecx, edi
jb 0x43a78c
jmp 0x43a7b4
push 0x455d78
call fcn.0043a73a
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x43a809
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x43a83f
test esi, esi
je 0x43a84a
xor edx, edx
test edi, edi
je 0x43a84a
mov ch, dl
mov cl, byte [edx + esi]
mov eax, edx
and eax, 0xf
mov al, byte [eax + ebx]
add al, ch
mov ch, cl
xor al, cl
mov byte [edx + esi], al
inc edx
cmp edx, edi
jb 0x43a824
jmp 0x43a84a
push 0x455d78
call fcn.00439d65
pop ecx
pop edi
pop esi
pop ebx
ret

Function at 0x43a89f
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x43a9de
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x464
push ebx
push esi
push edi
xor eax, eax
mov dword [esp + 0xc], ecx
push 0x208
push eax
mov dword [esp + 0x1c], eax
mov ebx, eax
lea eax, [esp + 0x20]
push eax
call fcn.004183a0
mov edi, dword [ebp + 8]
add esp, 0xc
test edi, edi
je 0x43abf7
cmp dword [ebp + 0xc], ebx
je 0x43abf7
push dword [ebp + 0xc]
lea eax, [esp + 0x1c]
push edi
push 0x45c788
push 0x104
push eax
call fcn.0041144b
add esp, 0x14
lea eax, [esp + 0x220]
push eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov esi, eax
mov dword [esp + 0x10], esi
cmp esi, 0xffffffff
je 0x43ab90
test byte [esp + 0x220], 0x10
je 0x43aae1
cmp byte [ebp + 0x10], 0
je 0x43aae1
push 0x45c794
lea eax, [esp + 0x250]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpW]
test eax, eax
je 0x43ab72
push 0x4607f0
lea eax, [esp + 0x250]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpW]
test eax, eax
je 0x43ab72
lea eax, [esp + 0x24c]
push eax
push edi
push 0x45c788
lea eax, [esp + 0x24]
push 0x104
push eax
call fcn.0041144b
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x2c]
add esp, 0x14
push dword [ebp + 0x10]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.0043a9de
add ebx, eax
jmp 0x43ab72
lea eax, [esp + 0x24c]
push eax
push edi
push 0x45c788
lea eax, [esp + 0x24]
push 0x104
push eax
call fcn.0041144b
add esp, 0x14
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
jne 0x43ab71
lea ecx, [esp + 0x18]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x14]
jne 0x43ab17
sub ecx, edx
sar ecx, 1
cmp ecx, dword [0x47cbb0]
jae 0x43ab71
mov esi, dword [0x47cbac]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
add eax, eax
push eax
lea eax, [esp + 0x1c]
push eax
push esi
call fcn.00430f64
add esp, 0xc
test eax, eax
je 0x43ab6d
push 4
xor eax, eax
push eax
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
mov eax, dword [esp + 0xc]
mov byte [eax], 1
mov esi, dword [esp + 0x10]
inc ebx
lea eax, [esp + 0x220]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x43aa5d
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
cmp byte [ebp + 0x14], 0
je 0x43abf3
push edi
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test eax, eax
je 0x43aba4
inc ebx
jmp 0x43abf3
mov ecx, edi
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x43abab
sub ecx, edx
sar ecx, 1
cmp ecx, dword [0x47cbb0]
jae 0x43abf3
mov esi, dword [0x47cbac]
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
add eax, eax
push eax
push edi
push esi
call fcn.00430f64
add esp, 0xc
test eax, eax
je 0x43abf3
push 4
xor eax, eax
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
mov eax, dword [esp + 0xc]
mov byte [eax], 1
mov eax, ebx
jmp 0x43abf9
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43ac02
Capabilities:
Get file system object information
Query or enumerate registry value

Disassembly:
sub esp, 0x6bc
lea eax, [esp + 0x208]
push ebx
push esi
mov ebx, 0x2b4
push ebx
push 0
push eax
call fcn.004183a0
mov esi, dword [esp + 0x6d4]
add esp, 0xc
test esi, esi
je 0x43ad71
push edi
mov edi, dword [esp + 0x6d0]
test edi, edi
je 0x43ad70
push ebp
mov ebp, dword [esp + 0x6d8]
test ebp, ebp
je 0x43ad6f
push 0x1000
xor eax, eax
mov word [edi], ax
lea eax, [esp + 0x21c]
or dword [ebp], 0xffffffff
push ebx
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea eax, [esp + 0x224]
push eax
call ebx
test eax, eax
jle 0x43aca6
lea eax, [esp + 0x224]
push eax
push edi
call ebx
mov ecx, edi
lea edx, [eax - 1]
call fcn.00411426
mov eax, dword [esp + 0x21c]
jmp 0x43ad6c
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x200
push eax
lea eax, [esp + 0x4d0]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
push eax
push SysReAllocString
call esi
push str.DefaultIcon
mov edx, 0x200
lea ecx, [esp + 0x4d0]
call fcn.004113af
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x104
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x4d4]
push eax
push SysReAllocString
call esi
lea eax, [esp + 0x18]
push 0x4607ec
push eax
call fcn.0041779d
mov dword [esp + 0x1c], eax
pop ecx
pop ecx
test eax, eax
je 0x43ad6f
push eax
call ebx
xor esi, esi
inc esi
sub esi, eax
lea eax, [esp + 0x18]
push eax
call ebx
push edi
lea ebx, [esi + eax]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
shr eax, 1
je 0x43ad5e
shr ebx, 1
cmp ebx, 0x7ffffffe
jbe 0x43ad4e
xor eax, eax
mov word [edi], ax
jmp 0x43ad5e
push ebx
lea ecx, [esp + 0x1c]
mov edx, eax
push ecx
push ecx
mov ecx, edi
call fcn.0043a927
mov eax, dword [esp + 0x14]
add eax, 2
push eax
call fcn.00425442
pop ecx
mov dword [ebp], eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x6bc
ret 0xc
Function at 0x43ad7c
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push edi
push 0x200
xor edi, edi
lea eax, [ebp - 0x208]
push edi
push eax
call fcn.004183a0
mov esi, dword [ebp + 0xc]
add esp, 0xc
mov dword [ebp - 4], edi
test esi, esi
je 0x43aeb5
cmp dword [ebp + 0x10], edi
je 0x43aeb5
lea eax, [ebp - 4]
push eax
push 0x44d6f0
push 1
push edi
push 0x44d720
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x43aeb5
mov edx, dword [ebp - 4]
test edx, edx
je 0x43aeb5
mov eax, dword [ebp + 0x20]
test eax, eax
jns 0x43adfd
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp - 0x208]
push eax
push esi
call fcn.0043ac02
mov eax, dword [ebp + 0x20]
mov edx, dword [ebp - 4]
cmp word [ebp - 0x208], di
mov ecx, dword [edx]
push eax
lea eax, [ebp - 0x208]
cmove eax, dword [ebp + 0x1c]
push eax
push edx
call dword [ecx + 0x44]
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push 0x100
mov dword [ebp - 8], edi
lea edx, [ebp - 0x208]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x40]
mov eax, dword [ebp - 4]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp - 4]
mov esi, 0x45ad90
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 4]
push dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp - 4]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [ebp - 4]
lea edx, [ebp + 0xc]
push edx
mov dword [ebp + 0xc], edi
push 0x44d730
mov ecx, dword [eax]
push eax
call dword [ecx]
mov esi, eax
test esi, esi
js 0x43aea3
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x43aea3
mov eax, dword [ecx]
push 1
push dword [ebp + 0x10]
push ecx
call dword [eax + 0x18]
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
not esi
shr esi, 0x1f
mov eax, esi
jmp 0x43aeb7
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c