joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b050
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0xbca84
call fcn.00432b00
mov eax, dword [0x4754f4]
xor eax, esp
mov dword [esp + 0xbca80], eax
push esi
mov esi, dword [ebp + 0x10]
xor eax, eax
push 0xfe
push eax
lea ecx, [esp + 0xbbf82]
push ecx
mov word [esp + 0xbbf84], ax
call fcn.0042c300
add esp, 0xc
lea edx, [esp + 4]
push edx
lea eax, [esp + 0xbbf7c]
push eax
mov dword [esp + 0xc], 0x80
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea ecx, [esp + 0xbbf78]
push 0x468064
push ecx
call fcn.004268f0
add esp, 8
test eax, eax
jne 0x40b162
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0xbc082]
push eax
mov word [esp + 0xbc084], dx
call fcn.0042c300
add esp, 0xc
push 0x104
lea ecx, [esp + 0xbc07c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
push 0x7fe
push edx
lea eax, [esp + 0xbc28a]
push eax
mov word [esp + 0xbc28c], dx
call fcn.0042c300
add esp, 0xc
push esi
lea ecx, [esp + 0xbc07c]
push ecx
lea edx, [esp + 0xbc288]
push str.__s___s
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [esp + 0xbc290]
push eax
call fcn.00416ed0
add esp, 0x14
xor eax, eax
pop esi
mov ecx, dword [esp + 0xbca80]
xor ecx, esp
call fcn.00420d00
mov esp, ebp
pop ebp
ret 0x10
push 0x40afd0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov ecx, dword [ebp + 8]
push esi
push ecx
lea edx, [esp + 0x10]
push edx
call fcn.00419f30
lea ecx, [esp + 8]
call fcn.0041a5b0
lea ecx, [esp + 8]
call fcn.0041a100
mov ecx, dword [esp + 0xbca84]
pop esi
xor ecx, esp
xor eax, eax
call fcn.00420d00
mov esp, ebp
pop ebp
ret 0x10

Function at 0x414d90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x4754f4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor eax, eax
push 0x3fe
push eax
lea ecx, [ebp - 0x402]
push ecx
mov dword [ebp - 0x408], 0
mov word [ebp - 0x404], ax
call fcn.0042c300
add esp, 0xc
push 0
push 0x28
lea edx, [ebp - 0x404]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push esi
lea edi, [ebp - 0x404]
call fcn.00406610
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, esi
pop edi
call fcn.00420d00
mov esp, ebp
pop ebp
ret

Function at 0x414e00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x4754f4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor eax, eax
push 0x3fe
push eax
lea ecx, [ebp - 0x402]
push ecx
mov dword [ebp - 0x408], 0
mov word [ebp - 0x404], ax
call fcn.0042c300
add esp, 0xc
push 0
push 0x28
lea edx, [ebp - 0x404]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str._funshion
lea eax, [ebp - 0x404]
push 0x200
push eax
call fcn.00428110
add esp, 0xc
push esi
lea edi, [ebp - 0x404]
call fcn.00406610
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, esi
pop edi
call fcn.00420d00
mov esp, ebp
pop ebp
ret
Function at 0x415020
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x457909
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x4754f4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
lea esi, [ebp - 0x54]
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x58], edi
call fcn.00414d90
push eax
lea eax, [ebp - 0x34]
push eax
mov ecx, str.Funshion_funshion.ini
mov dword [ebp - 4], 1
call fcn.00417a30
add esp, 8
mov esi, 8
mov byte [ebp - 4], 3
cmp dword [ebp - 0x3c], esi
jb 0x41509c
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.00425770
add esp, 4
lea eax, [ebp - 0x54]
xor edx, edx
push eax
mov dword [ebp - 0x3c], 7
mov dword [ebp - 0x40], edi
mov word [ebp - 0x50], dx
call fcn.00409010
push 0x800
call fcn.004217c0
add esp, 4
mov edi, eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x1c], esi
jae 0x4150cf
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x64]
push eax
mov eax, dword [ebp - 0x60]
push 0x400
push edi
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push ebx
call fcn.00406610
push edi
mov dword [ebp - 0x58], 1
call fcn.00425750
add esp, 4
mov byte [ebp - 4], 0
cmp dword [ebp - 0x1c], esi
jb 0x415113
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.00425770
add esp, 4
lea eax, [ebp - 0x34]
xor edx, edx
push eax
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], 0
mov word [ebp - 0x30], dx
call fcn.00409010
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00420d00
mov esp, ebp
pop ebp
ret
Function at 0x415150
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4578b0
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4754f4]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
push edi
mov eax, dword [0x4754f4]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov edi, ecx
lea esi, [esp + 0x30]
call fcn.00414d90
push eax
lea eax, [esp + 0x14]
push eax
mov ecx, str.Funshion_funshion.ini
mov dword [esp + 0x68], 0
call fcn.00417a30
add esp, 8
mov esi, 8
mov byte [esp + 0x60], 2
cmp dword [esp + 0x48], esi
jb 0x4151c9
mov ecx, dword [esp + 0x34]
push ecx
call fcn.00425770
add esp, 4
lea eax, [esp + 0x30]
xor edx, edx
push eax
mov dword [esp + 0x4c], 7
mov dword [esp + 0x48], 0
mov word [esp + 0x38], dx
call fcn.00409010
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], esi
jae 0x4151f8
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x415221
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], esi
jae 0x415211
lea eax, [esp + 0x14]
push eax
push edi
push ebx
push str.movieupdate
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
mov dword [esp + 0x60], 0xffffffff
cmp dword [esp + 0x28], esi
jb 0x41523c
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00425770
add esp, 4
lea eax, [esp + 0x10]
xor edx, edx
push eax
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], dx
call fcn.00409010
mov eax, edi
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00420d00
mov esp, ebp
pop ebp
ret

Function at 0x4153e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x4754f4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor eax, eax
push 0x3fe
push eax
lea ecx, [ebp - 0x402]
push ecx
mov dword [ebp - 0x408], 0
mov word [ebp - 0x404], ax
call fcn.0042c300
add esp, 0xc
push 0
push 0x10
lea edx, [ebp - 0x404]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push esi
lea edi, [ebp - 0x404]
call fcn.00406610
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, esi
pop edi
call fcn.00420d00
mov esp, ebp
pop ebp
ret

Function at 0x415450
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x4754f4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor eax, eax
push 0x3fe
push eax
lea ecx, [ebp - 0x402]
push ecx
mov dword [ebp - 0x408], 0
mov word [ebp - 0x404], ax
call fcn.0042c300
add esp, 0xc
push 0
push 0x19
lea edx, [ebp - 0x404]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push esi
lea edi, [ebp - 0x404]
call fcn.00406610
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, esi
pop edi
call fcn.00420d00
mov esp, ebp
pop ebp
ret
Function at 0x416df0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x4754f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 2
mov dword [ebp - 0x234], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x416eb7
push 0x228
lea eax, [ebp - 0x22c]
push 0
push eax
call fcn.0042c300
add esp, 0xc
lea ecx, [ebp - 0x230]
push ecx
push esi
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x416eb0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
lea esp, [esp]
lea edx, [ebp - 0x20c]
push str.explorer.exe
push edx
call fcn.004268f0
add esp, 8
test eax, eax
je 0x416e88
lea eax, [ebp - 0x230]
push eax
push esi
call edi
test eax, eax
jne 0x416e60
jmp 0x416eaf
mov ecx, dword [ebp - 0x228]
push ecx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea edx, [ebp - 0x234]
push edx
push 0xf01ff
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x234]
xor ecx, ebp
pop esi
call fcn.00420d00
mov esp, ebp
pop ebp
ret

Function at 0x416ed0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
push edi
call fcn.00416df0
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x416eef
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 1
push edi
lea eax, [ebp - 8]
push eax
mov esi, 0x20
mov dword [ebp - 8], ebx
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x416f0f
mov esi, 0x420
jmp 0x416f12
mov dword [ebp - 8], ebx
push 0x40
lea ecx, [ebp - 0x60]
push ebx
push ecx
call fcn.0042c300
mov ecx, dword [ebp - 8]
add esp, 0xc
xor eax, eax
lea edx, [ebp - 0x18]
push edx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x64]
push eax
push ebx
push ecx
push esi
push ebx
push ebx
push ebx
push edx
push ebx
push edi
mov dword [ebp - 0x64], 0x44
mov dword [ebp - 0x5c], str.WinSta0Default
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esi, eax
cmp esi, ebx
je 0x416f92
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0x416f6e
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov eax, dword [ebp - 0x18]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
mov ecx, dword [ebp - 0x14]
push ecx
call ebx
push edi
call ebx
xor eax, eax
cmp esi, 1
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call ebx
xor eax, eax
pop edi
cmp esi, 1
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416fd0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x4754f4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4170bc
mov eax, dword [ebp - 0x11c]
cmp eax, 6
jne 0x417077
cmp byte [ebp - 6], 1
jne 0x4170bc
mov eax, dword [ebp - 0x118]
sub eax, 0
je 0x417064
dec eax
je 0x417048
dec eax
jne 0x4170bc
call fcn.004170d0
neg eax
sbb eax, eax
neg eax
add eax, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420d00
mov esp, ebp
pop ebp
ret
call fcn.004170d0
neg eax
sbb eax, eax
neg eax
add eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420d00
mov esp, ebp
pop ebp
ret
mov eax, 6
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420d00
mov esp, ebp
pop ebp
ret
cmp eax, 5
jne 0x4170bc
mov eax, dword [ebp - 0x118]
cmp eax, 1
jne 0x417095
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420d00
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x4170bc
cmp byte [ebp - 6], 1
jne 0x4170bc
lea ecx, [ebp - 0x144]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x144], 9
mov eax, 1
je 0x4170c1
mov eax, 7
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420d00
mov esp, ebp
pop ebp
ret

Function at 0x417d80
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4570e6
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x4754f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x218], esi
mov dword [esi], 0
push 8
mov dword [ebp - 4], 0
call fcn.00426610
add esp, 4
test eax, eax
je 0x417e78
mov dword [esi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [esi]
mov dword [eax], esi
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ecx
mov word [esi + 4], cx
push 0x1fe
push edx
lea eax, [ebp - 0x20e]
mov dword [ebp - 4], 1
push eax
mov word [ebp - 0x210], dx
call fcn.0042c300
add esp, 0xc
push 0
push 5
lea ecx, [ebp - 0x210]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x46dbb8
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x417e40
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x210]
mov ecx, esi
call fcn.004098d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00420d00
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x214], 0
call fcn.004211a0
push 0x46ffcc
lea ecx, [ebp - 0x224]
push ecx
mov dword [ebp - method.std::bad_alloc.virtual_0], vtable.std::bad_alloc.0
call fcn.00432fc0
int3
Function at 0x417eb0
Capabilities:
Check if file exists
Create process on windows
Print debug messages

Disassembly:
cmp dword [edi + 0x18], 8
push esi
lea esi, [edi + 4]
jb 0x417ebe
mov eax, dword [esi]
jmp 0x417ec0
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x417ed8
push str._::PathFileExistsW
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop esi
ret
cmp dword [edi + 0x18], 8
jb 0x417ee0
mov esi, dword [esi]
push 1
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
ret

Function at 0x417f40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
mov eax, dword [0x4754f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x18], 8
push edi
lea edi, [esi + 4]
jb 0x417f65
mov eax, dword [edi]
jmp 0x417f67
mov eax, edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call ebx
test eax, eax
jne 0x417f89
cmp dword [esi + 0x18], 8
jb 0x417f7e
mov eax, dword [edi]
jmp 0x417f80
mov eax, edi
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x28e]
push ecx
mov word [ebp - 0x290], ax
call fcn.0042c300
add esp, 0xc
cmp dword [esi + 0x18], 8
jb 0x417faf
mov edi, dword [edi]
push edi
push 0x46dd30
lea edx, [ebp - 0x290]
call fcn.004149a0
add esp, 8
lea edx, [ebp - 0x290]
push edx
call ebx
test eax, eax
jne 0x417fd5
call fcn.004182e0
xor ecx, ecx
mov ebx, str.CreateDesktopLinkOnce
call fcn.00415150
cmp eax, 1
jne 0x417fef
call fcn.004189e0
test eax, eax
je 0x41806e
mov ecx, 1
mov ebx, str.updatetype
call fcn.00415150
test eax, eax
je 0x41800b
call fcn.004189e0
test eax, eax
jne 0x418046
call fcn.004189e0
test eax, eax
jne 0x41803c
push 1
push 0x46d834
lea eax, [ebp - 0x88]
push 0x40
push eax
call fcn.00427bf0
add esp, 0x10
lea ebx, [ebp - 0x88]
mov edi, str.CreateDesktopLinkOnce
call fcn.00415280
call fcn.004187c0
call fcn.00418460
push 1
push 0x46d834
lea ecx, [ebp - 0x88]
push 0x40
push ecx
call fcn.00427bf0
add esp, 0x10
lea ebx, [ebp - 0x88]
mov edi, str.updatetype
call fcn.00415280
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420d00
mov esp, ebp
pop ebp
ret
Function at 0x418080
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
mov eax, dword [0x4754f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x18], 8
push edi
lea edi, [esi + 4]
jb 0x4180a5
mov eax, dword [edi]
jmp 0x4180a7
mov eax, edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call ebx
test eax, eax
jne 0x4180c9
cmp dword [esi + 0x18], 8
jb 0x4180be
mov eax, dword [edi]
jmp 0x4180c0
mov eax, edi
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x28e]
push ecx
mov word [ebp - 0x290], ax
call fcn.0042c300
add esp, 0xc
cmp dword [esi + 0x18], 8
jb 0x4180ef
mov edi, dword [edi]
push edi
push 0x46dd30
lea edx, [ebp - 0x290]
call fcn.004149a0
add esp, 8
lea edx, [ebp - 0x290]
push edx
call ebx
test eax, eax
jne 0x418115
call fcn.004182e0
xor ecx, ecx
mov ebx, str.CreateDesktopLinkOnce
call fcn.00415150
cmp eax, 1
jne 0x418133
call fcn.004189e0
test eax, eax
je 0x4181b3
mov ecx, 1
mov ebx, str.updatetype
call fcn.00415150
cmp eax, 1
je 0x418150
call fcn.004189e0
test eax, eax
jne 0x41818b
call fcn.004189e0
test eax, eax
jne 0x418181
push 1
push 0x46d834
lea eax, [ebp - 0x88]
push 0x40
push eax
call fcn.00427bf0
add esp, 0x10
lea ebx, [ebp - 0x88]
mov edi, str.CreateDesktopLinkOnce
call fcn.00415280
call fcn.004187c0
call fcn.004181d0
push 0
push 0x46d834
lea ecx, [ebp - 0x88]
push 0x40
push ecx
call fcn.00427bf0
add esp, 0x10
lea ebx, [ebp - 0x88]
mov edi, str.updatetype
call fcn.00415280
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420d00
mov esp, ebp
pop ebp
ret
Function at 0x418580
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45765b
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x4754f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0
mov dword [ebp - 0x244], eax
mov edi, ecx
mov ebx, edx
je 0x418613
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x23c]
push eax
push 0x45a60c
push 1
push 0
push 0x45a61c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x418613
mov eax, dword [ebp - 0x23c]
mov ecx, dword [eax]
lea edx, [ebp - 0x240]
push edx
push 0x45a62c
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jns 0x41861a
mov eax, dword [ebp - 0x23c]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor eax, eax
jmp 0x41879a
lea esi, [ebp - 0x238]
call fcn.00414e90
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x234]
mov esi, 8
cmp dword [ebp - 0x220], esi
jae 0x418645
lea ecx, [ebp - 0x234]
mov eax, dword [ebp - 0x23c]
mov edx, dword [eax]
push ecx
push eax
mov eax, dword [edx + 0x50]
call eax
cmp dword [edi + 0x18], esi
jb 0x41865e
mov edi, dword [edi + 4]
jmp 0x418661
add edi, 4
mov eax, dword [ebp - 0x23c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push edi
push eax
call edx
mov ecx, dword [ebp - 0x234]
cmp dword [ebp - 0x220], esi
jae 0x418684
lea ecx, [ebp - 0x234]
mov eax, dword [ebp - 0x23c]
mov edi, dword [ebp + 0xc]
mov edx, dword [eax]
push edi
push ecx
push eax
mov eax, dword [edx + 0x44]
call eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0x23c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push 0x46dc58
push eax
call edx
mov eax, dword [ebp - 0x23c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x3c]
push 5
push eax
call edx
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x216]
push ecx
mov word [ebp - 0x218], ax
call fcn.0042c300
add esp, 0xc
cmp dword [ebx + 0x18], esi
jb 0x4186e8
mov ebx, dword [ebx + 4]
jmp 0x4186eb
add ebx, 4
mov eax, dword [ebp - 0x244]
cmp dword [eax + 0x18], esi
jb 0x4186fb
mov eax, dword [eax + 4]
jmp 0x4186fe
add eax, 4
push ebx
push eax
lea edx, [ebp - 0x218]
push str._s_s.lnk
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp - 0x240]
mov ecx, dword [eax]
add esp, 0x10
push 1
lea edx, [ebp - 0x218]
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
mov eax, dword [ebp - 0x240]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x23c]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x220], esi
jb 0x41876c
mov eax, dword [ebp - 0x234]
push eax
call fcn.00425770
add esp, 4
lea edx, [ebp - 0x238]
xor ecx, ecx
push edx
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], cx
call fcn.00409010
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00420d00
mov esp, ebp
pop ebp
ret 8
Function at 0x4187c0
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x457c43
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x4754f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea esi, [ebp - 0x50]
call fcn.004153e0
push eax
lea eax, [ebp - 0x30]
xor esi, esi
push eax
mov ecx, 0x46dc78
mov dword [ebp - 4], esi
call fcn.00417a30
add esp, 8
mov ebx, 8
mov byte [ebp - 4], 2
cmp dword [ebp - 0x38], ebx
jb 0x418827
mov ecx, dword [ebp - 0x4c]
push ecx
call fcn.00425770
add esp, 4
lea eax, [ebp - 0x50]
xor edx, edx
push eax
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x3c], esi
mov word [ebp - 0x4c], dx
call fcn.00409010
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], ebx
jae 0x41884b
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4188ef
lea esi, [ebp - 0x90]
call fcn.00415450
push eax
lea ecx, [ebp - 0x70]
push ecx
mov ecx, 0x46dc78
mov byte [ebp - 4], 3
call fcn.00417a30
add esp, 8
mov esi, eax
lea edi, [ebp - 0x30]
mov byte [ebp - 4], 4
call fcn.00408120
mov byte [ebp - 4], 3
cmp dword [ebp - 0x58], ebx
jb 0x41889e
mov edx, dword [ebp - 0x6c]
push edx
call fcn.00425770
add esp, 4
lea ecx, [ebp - 0x70]
xor eax, eax
mov esi, 7
xor edi, edi
push ecx
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x5c], edi
mov word [ebp - 0x6c], ax
call fcn.00409010
mov byte [ebp - 4], 2
cmp dword [ebp - 0x78], ebx
jb 0x4188d2
mov edx, dword [ebp - 0x8c]
push edx
call fcn.00425770
add esp, 4
lea ecx, [ebp - 0x90]
xor eax, eax
push ecx
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x7c], edi
mov word [ebp - 0x8c], ax
call fcn.00409010
xor esi, esi
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], ebx
jae 0x4188fa
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], ebx
jb 0x418919
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00425770
add esp, 4
lea ecx, [ebp - 0x30]
xor eax, eax
push ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x2c], ax
call fcn.00409010
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00420d00
mov esp, ebp
pop ebp
ret

Function at 0x418950
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4754f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.0042c300
add esp, 0xc
cmp dword [esi + 0x18], 8
jb 0x41898f
mov esi, dword [esi + 4]
jmp 0x418992
add esi, 4
push esi
push 0x46dcfc
lea edx, [ebp - 0x20c]
call fcn.004149a0
add esp, 8
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop esi
test eax, eax
je 0x4189c5
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420d00
mov esp, ebp
pop ebp
ret