joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412a90
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x218
mov eax, dword [0x46420c]
push esi
push edi
mov dword [esp + 0x21c], eax
xor eax, eax
mov word [esp + 0x10], 0
mov ecx, 0x81
lea edi, [esp + 0x12]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 8]
push eax
push 0xf003f
xor esi, esi
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall360
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x412b1d
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
push eax
push eax
mov eax, dword [esp + 0x18]
push 0x4527c8
push eax
mov dword [esp + 0x24], 0x3e8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x412b0e
mov esi, 1
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x412b31
xor eax, eax
mov ecx, dword [esp + 0x21c]
call fcn.0042b3a1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [esp + 0x21c]
neg eax
sbb eax, eax
neg eax
call fcn.0042b3a1
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x413510
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x46420c]
push edi
mov dword [esp + 0x214], eax
xor eax, eax
mov word [esp + 8], 0
mov ecx, 0x81
lea edi, [esp + 0xa]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x41358f
push 0x104
push 0
push 0
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
lea edx, [esp + 0x24]
push edx
mov word [esp + 0x2e], 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov eax, dword [esp + 4]
mov ecx, dword [ebp + 8]
push eax
push str._.8X
push ecx
call fcn.0042b87a
add esp, 0xc
mov ecx, dword [esp + 0x214]
call fcn.0042b3a1
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x414030
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
mov eax, dword [0x46420c]
push edi
mov dword [esp + 0x12c], eax
xor eax, eax
mov ecx, 0x47
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0xc], 6
jne 0x41409d
mov eax, dword [esp + 0x10]
test eax, eax
je 0x41407d
cmp eax, 1
jne 0x41409d
cmp byte [esp + 0x122], 1
jne 0x41409d
mov eax, 1
mov ecx, dword [esp + 0x12c]
call fcn.0042b3a1
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x12c]
xor eax, eax
call fcn.0042b3a1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4140b0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa3c
mov eax, dword [0x46420c]
mov dword [esp + 0xa38], eax
push ebx
xor ebx, ebx
xor eax, eax
push esi
push edi
mov esi, ecx
mov word [esp + 0x838], bx
mov ecx, 0x81
lea edi, [esp + 0x83a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x428], bx
mov ecx, 0x81
lea edi, [esp + 0x42a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x220], bx
mov ecx, 0x81
lea edi, [esp + 0x222]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x630], bx
mov ecx, 0x81
lea edi, [esp + 0x632]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x18], bx
mov ecx, 0x81
lea edi, [esp + 0x1a]
rep stosd dword es:[edi], eax
push ebx
stosw word es:[edi], ax
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x1a
lea eax, [esp + 0x840]
push eax
push ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], ebx
call edi
lea ecx, [esp + 0x838]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.0042be85
lea eax, [esp + 0x20]
push eax
call fcn.0042baa6
lea ecx, [esp + 0x24]
push 0x5c
push ecx
call fcn.0042c306
add esp, 0x14
cmp eax, ebx
je 0x4142af
lea edx, [esp + 0x18]
mov word [eax], bx
push edx
lea eax, [esp + 0x42c]
push eax
call fcn.0042be85
lea ecx, [esp + 0x430]
push str.Local
push ecx
call fcn.0042be5b
add esp, 0x10
lea edx, [esp + 0x428]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4141e2
mov dword [esp + 0x10], 1
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x224]
push ecx
call fcn.0042be85
lea edx, [esp + 0x228]
push str.LocalLow
push edx
call fcn.0042be5b
add esp, 0x10
lea eax, [esp + 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x414223
mov dword [esp + 0xc], 1
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x634]
push edx
call fcn.0042be85
lea eax, [esp + 0x638]
push str.Roaming
push eax
call fcn.0042be5b
add esp, 0x10
lea ecx, [esp + 0x630]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov eax, 1
jne 0x414265
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x10], ebx
je 0x4142af
cmp dword [esp + 0xc], ebx
je 0x4142af
cmp eax, ebx
je 0x4142af
mov ecx, esi
call fcn.00414030
test eax, eax
je 0x4142af
lea edx, [esp + 0x220]
push edx
push esi
call fcn.0042be85
push 0x44fef0
push esi
call fcn.0042be5b
add esp, 0x10
mov ecx, dword [esp + 0xa44]
call fcn.0042b3a1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push 0x1a
push esi
push ebx
call edi
push 0x44fef0
push esi
call fcn.0042be5b
mov ecx, dword [esp + 0xa4c]
add esp, 8
call fcn.0042b3a1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4142e0
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44ce86
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x428
mov eax, dword [0x46420c]
push ebx
push esi
push edi
mov dword [esp + 0x42c], eax
mov dword [esp + 0x14], ecx
call fcn.0043f04a
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0xc], esi
xor edi, edi
mov dword [esp + 0x43c], edi
call fcn.0043f04a
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ebx, [eax + 0x10]
mov dword [esp + 0x10], ebx
mov word [esp + 0x18], di
xor eax, eax
mov ecx, 0x81
lea edi, [esp + 0x1a]
rep stosd dword es:[edi], eax
push 0
stosw word es:[edi], ax
push 0x1a
lea eax, [esp + 0x20]
push eax
push 0
mov byte [esp + 0x44c], 1
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41440a
lea ecx, [esp + 0x18]
push str.MicrosoftInternet_ExplorerQuick_Launch
push ecx
call fcn.0042be5b
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push 0x450dc8
push eax
call fcn.00402810
mov esi, dword [esp + 0x20]
add esp, 0x14
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41440a
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea ecx, [esp + 0x224]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edx, [esp + 0x220]
push edx
lea eax, [esp + 0x14]
push str.__sProgram_FilesInternet_Exploreriexplore.exe_
push eax
mov word [esp + 0x232], 0
call fcn.00402810
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
add esp, 0xc
push 0
push str._HOMEDRIVE__HOMEPATH_
push 0
push 1
push 0x450d00
push ebx
push esi
call fcn.00409650
add ebx, 0xfffffff0
mov byte [esp + 0x43c], 0
lea ecx, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41442c
mov ecx, dword [ebx]
mov eax, dword [ecx]
push ebx
call dword [eax + 4]
add esi, 0xfffffff0
mov dword [esp + 0x43c], 0xffffffff
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414451
mov ecx, dword [esi]
mov eax, dword [ecx]
push esi
call dword [eax + 4]
mov ecx, dword [esp + 0x434]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x42c]
mov eax, 1
call fcn.0042b3a1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x414480
Capabilities:
Set registry value

Disassembly:
push ecx
push edi
lea eax, [esp + 4]
push eax
push 0xf003f
push 0
push 0x450c08
push SysReAllocString
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4144ab
xor eax, eax
pop edi
pop ecx
ret 4
push esi
mov esi, dword [esp + 0x10]
push esi
call fcn.0042baa6
mov ecx, dword [esp + 0xc]
add esp, 4
shl eax, 1
push eax
push esi
push 1
push 0
push str.Start_Page
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, edi
call fcn.004142e0
pop esi
mov eax, 1
pop edi
pop ecx
ret 4
Function at 0x414d40
Capabilities:
Set registry value

Disassembly:
sub esp, 0xa3c
mov eax, dword [0x46420c]
push esi
push edi
mov dword [esp + 0xa40], eax
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push str.softwareMicrosoftWindowsCurrentVersionUninstall
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x414ec1
mov edx, dword [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
push eax
push 0xf003f
push eax
push eax
push eax
push 0x450360
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x414eba
lea eax, [esp + 0x18]
push 0x450360
push eax
call fcn.0042b87a
mov ecx, dword [0x46532c]
mov edx, dword [ecx + 0x14]
mov eax, dword [edx + 0x224]
push eax
lea ecx, [esp + 0x63c]
push str._sUninst.exe
push ecx
call fcn.0042b87a
mov edx, dword [0x46532c]
mov eax, dword [edx + 0x14]
mov ecx, dword [eax + 0x224]
push ecx
lea edx, [esp + 0x238]
push str._suninst.exe
push edx
call fcn.0042b87a
lea eax, [esp + 0x448]
push 0x452d1c
push eax
call fcn.0042b87a
lea ecx, [esp + 0x860]
push str.http:__www.wn51.com_
push ecx
call fcn.0042b87a
mov eax, dword [esp + 0x38]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esp, 0x30
push 0x104
lea edx, [esp + 0x1c]
push edx
push 1
push 0
push str.DisplayName
push eax
call esi
mov edx, dword [esp + 8]
push 0x104
lea ecx, [esp + 0x634]
push ecx
push 1
push 0
push 0x4527c8
push edx
call esi
mov ecx, dword [esp + 8]
push 0x104
lea eax, [esp + 0x224]
push eax
push 1
push 0
push str.DisplayIcon
push ecx
call esi
mov eax, dword [esp + 8]
push 0x104
lea edx, [esp + 0x42c]
push edx
push 1
push 0
push str.Publisher
push eax
call esi
mov edx, dword [esp + 8]
push 0x104
lea ecx, [esp + 0x83c]
push ecx
push 1
push 0
push str.URLInfoAbout
push edx
call esi
mov eax, dword [esp + 8]
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
lea edx, [esp + 0x10]
push edx
push str.wnDealDown
push SysReAllocString
call edi
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueW]
push 0
push str.wnDealDownfiles
push 1
push 0x44fd64
push eax
call esi
mov ecx, dword [esp + 0x10]
push 0x104
push str.wnDealDown.exe__1
push 1
push str.shellopencommand_
push ecx
call esi
lea edx, [esp + 0x14]
push edx
push 0x452c18
push SysReAllocString
call edi
mov eax, dword [esp + 0x14]
push 0x104
push str.wnDealDown
push 1
push 0x44fd64
push eax
call esi
mov ecx, dword [esp + 0xa40]
pop edi
pop esi
call fcn.0042b3a1
add esp, 0xa3c
ret
Function at 0x414f50
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x414f70
xor eax, eax
add esp, 0x14
ret
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp]
push 0
push 0
push 0
lea edx, [esp + 0x10]
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x414f6a
push eax
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
add esp, 0x14
ret

Function at 0x4150a0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x46c
mov eax, dword [0x46420c]
push edi
mov dword [esp + 0x46c], eax
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, dword [0x46532c]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], 0x44
mov dword [esp + 0x10], eax
mov edx, dword [ecx + 0x14]
mov eax, dword [edx + 0x29c]
mov ecx, dword [eax + 0x48]
push str._BuildTable
push str.wnwbWnExeTool.exe
push ecx
lea edx, [esp + 0x68]
push str._s_s__s
push edx
call fcn.0042b87a
add esp, 0x14
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
lea edx, [esp + 0x7c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
pop edi
jne 0x415173
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x264]
push 0x452e0c
push ecx
call fcn.0042b87a
mov ecx, dword [0x46532c]
add esp, 0xc
push 0
lea edx, [esp + 0x264]
push edx
call fcn.0040a230
xor eax, eax
mov ecx, dword [esp + 0x468]
call fcn.0042b3a1
add esp, 0x46c
ret
mov eax, dword [esp]
push esi
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 4]
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp + 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
lea edx, [esp + 0x5c]
push edx
lea eax, [esp + 0x268]
push 0x452df8
push eax
call fcn.0042b87a
add esp, 0xc
push 0
lea ecx, [esp + 0x268]
push ecx
mov ecx, dword [0x46532c]
call fcn.0040a230
mov ecx, dword [esp + 0x46c]
mov eax, 1
pop esi
call fcn.0042b3a1
add esp, 0x46c
ret
Function at 0x4151f0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x46c
mov eax, dword [0x46420c]
mov dword [esp + 0x468], eax
xor eax, eax
push edi
mov edx, ecx
mov ecx, 0x11
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov eax, dword [edx + 0x3c]
test eax, eax
mov dword [esp + 0x18], 0x44
pop edi
je 0x41525b
mov ecx, dword [0x46532c]
mov edx, dword [ecx + 0x14]
mov eax, dword [edx + 0x29c]
mov ecx, dword [eax + 0x48]
push str._SetDefault_StartUp
push str.wnwbWnExeTool.exe
push ecx
push str._s_s__s
lea edx, [esp + 0x68]
push edx
jmp 0x415281
mov eax, dword [0x46532c]
mov ecx, dword [eax + 0x14]
mov edx, dword [ecx + 0x29c]
mov eax, dword [edx + 0x48]
push str._SetDefault
push str.wnwbWnExeTool.exe
push eax
push str._s_s__s
lea ecx, [esp + 0x68]
push ecx
call fcn.0042b87a
add esp, 0x14
lea edx, [esp]
push edx
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea ecx, [esp + 0x78]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4152f3
lea edx, [esp + 0x58]
push edx
lea eax, [esp + 0x264]
push 0x452e0c
push eax
call fcn.0042b87a
add esp, 0xc
push 0
lea ecx, [esp + 0x264]
push ecx
mov ecx, dword [0x46532c]
call fcn.0040a230
xor eax, eax
mov ecx, dword [esp + 0x468]
call fcn.0042b3a1
add esp, 0x46c
ret
mov edx, dword [esp]
push esi
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 4]
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [esp + 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 8]
push eax
call esi
lea ecx, [esp + 0x5c]
push ecx
lea edx, [esp + 0x268]
push 0x452df8
push edx
call fcn.0042b87a
mov ecx, dword [0x46532c]
add esp, 0xc
push 0
lea eax, [esp + 0x268]
push eax
call fcn.0040a230
mov ecx, dword [esp + 0x46c]
mov eax, 1
pop esi
call fcn.0042b3a1
add esp, 0x46c
ret
Function at 0x41a210
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44d5b1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x220
mov eax, dword [0x46420c]
push ebx
push esi
push edi
mov dword [esp + 0x224], eax
mov ebx, ecx
xor esi, esi
xor eax, eax
mov word [esp + 0x18], si
mov ecx, 0x81
lea edi, [esp + 0x1a]
rep stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
push 0x16
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41a3b5
call fcn.0043f04a
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 0x234], esi
call fcn.0043f04a
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10]
push 0x453710
push ecx
mov byte [esp + 0x240], 1
call fcn.00402810
mov edx, dword [esp + 0x18]
add esp, 0xc
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10]
push 0x4536f0
push ecx
call fcn.00402810
mov edx, dword [0x46532c]
mov eax, dword [edx + 0x14]
mov ecx, dword [eax + 0x224]
push ecx
lea edx, [esp + 0x20]
push str._swnwbwnwb.exe
push edx
call fcn.00402810
mov eax, dword [0x46532c]
mov ecx, dword [eax + 0x14]
add esp, 0x18
push str.wnwb
add ecx, 0x224
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00403e70
mov eax, dword [eax]
mov edi, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push eax
push 0x657
push 1
push 0x4536ac
push esi
push edi
mov ecx, ebx
mov byte [esp + 0x250], 2
call fcn.00419ce0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x234], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41a369
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
add esi, 0xfffffff0
mov byte [esp + 0x234], 0
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41a38b
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
lea eax, [edi - 0x10]
mov dword [esp + 0x234], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41a3b0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, 1
mov ecx, dword [esp + 0x22c]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x224]
call fcn.0042b3a1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41a3e0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44d5b1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x220
mov eax, dword [0x46420c]
push ebx
push esi
push edi
mov dword [esp + 0x224], eax
mov ebx, ecx
xor esi, esi
xor eax, eax
mov word [esp + 0x18], si
mov ecx, 0x81
lea edi, [esp + 0x1a]
rep stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
push 0x17
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41a585
call fcn.0043f04a
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 0x234], esi
call fcn.0043f04a
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10]
push 0x453710
push ecx
mov byte [esp + 0x240], 1
call fcn.00402810
mov edx, dword [esp + 0x18]
add esp, 0xc
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10]
push 0x4536f0
push ecx
call fcn.00402810
mov edx, dword [0x46532c]
mov eax, dword [edx + 0x14]
mov ecx, dword [eax + 0x224]
push ecx
lea edx, [esp + 0x20]
push str._swnwbwnwb.exe
push edx
call fcn.00402810
mov eax, dword [0x46532c]
mov ecx, dword [eax + 0x14]
add esp, 0x18
push str.wnwb
add ecx, 0x224
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00403e70
mov eax, dword [eax]
mov edi, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push eax
push 0x657
push 1
push 0x4536ac
push esi
push edi
mov ecx, ebx
mov byte [esp + 0x250], 2
call fcn.00419ce0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x234], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41a539
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
add esi, 0xfffffff0
mov byte [esp + 0x234], 0
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41a55b
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
lea eax, [edi - 0x10]
mov dword [esp + 0x234], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41a580
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, 1
mov ecx, dword [esp + 0x22c]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x224]
call fcn.0042b3a1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41a5b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44d5b1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x220
mov eax, dword [0x46420c]
push ebx
push esi
push edi
mov dword [esp + 0x224], eax
mov ebx, ecx
call fcn.0043f04a
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
xor edi, edi
mov dword [esp + 0x234], edi
call fcn.0043f04a
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x10], esi
mov word [esp + 0x18], di
xor eax, eax
mov ecx, 0x81
lea edi, [esp + 0x1a]
rep stosd dword es:[edi], eax
push 0
stosw word es:[edi], ax
push 0x1a
lea eax, [esp + 0x20]
push eax
push 0
mov byte [esp + 0x244], 1
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41a6f9
lea ecx, [esp + 0x18]
push str.MicrosoftInternet_ExplorerQuick_Launch
push ecx
call fcn.0042be5b
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push 0x4538a0
push eax
call fcn.00402810
mov ecx, dword [0x46532c]
mov edx, dword [ecx + 0x14]
mov eax, dword [edx + 0x224]
push eax
lea ecx, [esp + 0x28]
push str._swnwbwnwb.exe
push ecx
call fcn.00402810
mov edx, dword [0x46532c]
mov eax, dword [edx + 0x14]
add esp, 0x20
push str.wnwb
add eax, 0x224
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00403e70
mov eax, dword [eax]
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push 0
push eax
push 0x657
push 1
push 0x4536ac
push esi
push edx
mov ecx, ebx
mov byte [esp + 0x250], 2
call fcn.00419ce0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x234], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41a6f9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
add esi, 0xfffffff0
mov byte [esp + 0x234], 0
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41a71b
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x234], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41a744
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x22c]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x224]
mov eax, 1
call fcn.0042b3a1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret