joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440b50
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x40
mov esi, dword [ebp + 8]
mov eax, dword [0x59d024]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x20]
mov dword [edi], 0xffffffff
mov ecx, edi
call fcn.0043fcb0
mov edi, dword [edi]
test edi, edi
je 0x440bea
xor eax, eax
lea ebx, [ebp - 0x1c]
mov dword [ebx], eax
lea ecx, [ebp - 0x18]
mov dword [ecx], eax
mov word [ecx + 4], 0x500
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], eax
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
movaps xmm0, xmmword [0x5869d0]
movups xmmword [esp + 4], xmm0
mov dword [esp], ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
sub esp, 0x2c
mov ebx, dword [ebx]
test eax, eax
je 0x440bef
test ebx, ebx
je 0x440bff
mov eax, dword [edi]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
sub esp, 8
cmp eax, 1
mov byte [esi], 1
sete byte [esi + 1]
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
sub esp, 4
jmp 0x440c02
mov byte [esi], 0
jmp 0x440c0e
test ebx, ebx
je 0x440bff
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
sub esp, 4
mov byte [esi], 0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ed092
mov eax, esi
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x440c30
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x2c
mov esi, dword [ebp + 8]
mov eax, dword [0x59d024]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea edi, [ebp - 0x10]
mov dword [edi], 0xffffffff
mov ecx, edi
call fcn.0043fcb0
mov edi, dword [edi]
test edi, edi
je 0x440ca0
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x14], 0
cmp byte [ecx + 0xb], 0
jns 0x440c70
mov ecx, dword [ecx]
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
lea edx, [ebp - 0x14]
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov dword [esp], ecx
mov dword [esp + 8], 1
call dword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
sub esp, 0x20
test eax, eax
je 0x440ca5
mov byte [esi], 0
jmp 0x440cc4
mov byte [esi], 0
jmp 0x440cd0
mov eax, dword [ebp - 0x14]
mov ecx, dword [edi]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
sub esp, 8
cmp eax, 1
mov byte [esi], 1
sete byte [esi + 1]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004ed092
mov eax, esi
add esp, 0x2c
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x441200
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc8
mov edi, edx
mov dword [esp + 4], ecx
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x59d024]
xor eax, ebp
mov dword [esp + 0xc0], eax
xor eax, eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb8], eax
lea esi, [ebx + 0xf]
test ebx, ebx
cmovns esi, ebx
mov eax, esi
sar eax, 4
inc eax
movzx eax, ax
movzx ecx, word [ebp + 8]
push ecx
push eax
push 6
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x4412b5
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4412ea
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x441390
push 2
call fcn.004b4490
add esp, 4
test al, al
je 0x44132d
call fcn.005393f0
lea edi, [esp + 8]
mov ecx, edi
push eax
push 2
push 0x45
push str.....operadesktopwindowsl10n_handler_resource_l10n_handler.cc
call fcn.00539530
lea eax, [esp + 0x10]
push 0x15
push str.Failed_to_lock_string
jmp 0x44131d
push 2
call fcn.004b4490
add esp, 4
test al, al
je 0x44132d
call fcn.005393f0
lea edi, [esp + 8]
mov ecx, edi
push eax
push 2
push 0x39
push str.....operadesktopwindowsl10n_handler_resource_l10n_handler.cc
call fcn.00539530
lea eax, [esp + 0x10]
push 0x15
push str.Failed_to_find_string
jmp 0x44131d
push 2
call fcn.004b4490
add esp, 4
test al, al
je 0x44132d
call fcn.005393f0
lea edi, [esp + 8]
mov ecx, edi
push eax
push 2
push 0x3f
push str.....operadesktopwindowsl10n_handler_resource_l10n_handler.cc
call fcn.00539530
lea eax, [esp + 0x10]
push 0x15
push str.Failed_to_load_string
push eax
call fcn.0051d150
add esp, 0xc
mov ecx, edi
call fcn.00539590
mov eax, dword [esp + 0xb8]
mov esi, dword [esp + 4]
mov dword [esi + 8], eax
movsd xmm0, qword [esp + 0xb0]
movsd qword [esi], xmm0
xor eax, eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb8], eax
cmp byte [esp + 0xbb], 0
jns 0x441378
push dword [esp + 0xb0]
call fcn.004eca8e
add esp, 4
mov ecx, dword [esp + 0xc0]
xor ecx, ebp
call fcn.004ed092
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
and esi, 0xfffffff0
sub ebx, esi
test ebx, ebx
jle 0x4413a5
movzx ecx, word [eax]
lea eax, [eax + ecx*2]
add eax, 2
dec ebx
jne 0x441399
movzx ecx, word [eax]
add eax, 2
jne 0x4413b2
test cx, cx
jne 0x441409
mov esi, dword [ebp + 0x10]
movzx edx, cx
lea edi, [esp + 0xb0]
mov ecx, edi
push edx
push eax
call fcn.00468e50
mov eax, dword [esi]
cmp eax, dword [esi + 4]
je 0x44132d
movzx eax, byte [esp + 0xbb]
test al, al
jns 0x4413ef
mov edi, dword [esp + 0xb0]
mov eax, dword [esp + 0xb4]
jmp 0x4413f2
and eax, 0x7f
push 0
push esi
push eax
push edi
mov esi, dword [esp + 0x14]
push esi
call fcn.0053f9b0
add esp, 0x14
jmp 0x44135f
push str.string::assign_received_nullptr
push str.__n__0____s___nullptr
push 0x9a4
push str....._buildtools_third_partylibc_trunkinclude_string
push str._s:_d:_assertion__s_failed:__s
call fcn.0051d7e0
int3
Function at 0x443c30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x59d024]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x1c]
mov dword [esi], 0
push esi
push 0x441430
push 6
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
cmp eax, 1
jne 0x443d2c
push 0x586c58
push 0x86
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
mov dword [ebp - 0x1c], 0
push esi
push 0x441430
push 6
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
cmp eax, 1
jne 0x443d2f
push edi
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 0x1c], 0
push esi
push 0x441430
push 6
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
cmp eax, 1
jne 0x443d32
push edi
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebx
push esi
call fcn.00477840
add esp, 0xc
movzx eax, byte [ebp - 0x11]
test al, al
jns 0x443ce8
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
jmp 0x443ceb
and eax, 0x7f
xor ecx, ecx
inc ecx
push 0
push ecx
push ecx
push 0x5853a0
push eax
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0047de50
add esp, 0x1c
cmp byte [ebp - 0x11], 0
jns 0x443d16
push dword [ebp - 0x1c]
call fcn.004eca8e
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ed092
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
int3
int3
int3
Function at 0x443fd0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xc0
mov esi, esp
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x59d024]
xor eax, ebp
mov dword [esi + 0xb8], eax
pxor xmm0, xmm0
movdqu xmmword [esi + 0x3c], xmm0
movdqu xmmword [esi + 0x5c], xmm0
movdqu xmmword [esi + 0x4c], xmm0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x34], 0x3c
mov dword [esi + 0x38], 0x40
mov dword [esi + 0x40], str.runas
xor ebx, ebx
dec ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
lea edi, [esi + 0x70]
push edi
call fcn.0046b3b0
cmp byte [edi + 0xb], 0
js 0x444159
mov eax, dword [esi + 0x78]
mov dword [esi + 0x30], eax
movq xmm0, qword [esi + 0x70]
movq qword [esi + 0x28], xmm0
lea ecx, [esi + 0x70]
call fcn.004b3560
cmp byte [esi + 0x33], 0
jns 0x444065
mov eax, dword [esi + 0x28]
jmp 0x444068
lea eax, [esi + 0x28]
mov dword [esi + 0x44], eax
lea edi, [esi + 0x1c]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov ecx, dword [ebp + 0xc]
push edi
call fcn.0046c140
cmp byte [edi + 0xb], 0
jns 0x444088
mov edi, dword [esi + 0x1c]
lea eax, [esi + 0x34]
mov dword [eax + 0x14], edi
mov dword [eax + 0x1c], 5
pcmpeqd xmm0, xmm0
lea ebx, [esi + 0x70]
movdqa xmmword [ebx + 0x30], xmm0
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea edi, [esi + 0xc]
push 0x176
push str.....operadesktopwindowsos_operationsos_operations_impl.cc
push str.RunElevatedProcess
push edi
call fcn.004b4450
add esp, 0x10
mov ecx, ebx
push 0
push edi
call fcn.004be2f0
lea eax, [esi + 0x34]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [esi + 4], esp
sub esp, 0xc
mov ebx, esp
lea ecx, [ebx + 4]
test eax, eax
je 0x4440f2
push dword [esi + 0x6c]
jmp 0x4440f4
push 0
call fcn.004c2d10
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov edi, dword [esi + 8]
mov eax, dword [edi]
mov ebx, dword [eax + 0x60]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, edi
call ebx
mov esp, dword [esi + 4]
lea ecx, [esi + 0x70]
call fcn.004be370
cmp byte [esi + 0x27], 0
jns 0x44412e
push dword [esi + 0x1c]
call fcn.004eca8e
add esp, 4
cmp byte [esi + 0x33], 0
jns 0x44413f
push dword [esi + 0x28]
call fcn.004eca8e
add esp, 4
mov ecx, dword [esi + 0xb8]
xor ecx, ebp
call fcn.004ed092
mov eax, dword [ebp + 8]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
lea ecx, [esi + 0x28]
push dword [esi + 0x74]
push dword [esi + 0x70]
call fcn.00468b90
jmp 0x444052
Function at 0x4441c0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x90
mov esi, dword [ebp + 0xc]
mov eax, dword [0x59d024]
xor eax, ebp
mov dword [esp + 0x88], eax
mov ebx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x18]
mov eax, 0xc
push eax
call fcn.004eca5e
add esp, 4
mov ecx, 0xc
mov dword [esp + 0x1c], ecx
mov edx, eax
xor eax, eax
mov dword [esp + 0x20], eax
movzx ecx, byte [ebp + 0x10]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
mov dword [edx], fcn.00444f20
mov dword [esp], edx
mov byte [edx + 8], 0
cmp byte [esi + 0xb], 0
mov dword [esp + 8], edi
jns 0x44422e
mov esi, dword [esi]
lea ecx, [esp + 0x1c]
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov eax, dword [esp]
mov dword [eax + 4], esi
test esi, esi
je 0x444308
pcmpeqd xmm0, xmm0
mov ecx, ebx
lea ebx, [esp + 0x38]
movdqa xmmword [ebx - 8], xmm0
movdqa xmmword [ebx + 8], xmm0
movdqa xmmword [ebx + 0x18], xmm0
movdqa xmmword [ebx + 0x28], xmm0
movdqa xmmword [ebx + 0x38], xmm0
mov byte [ebx - 8], 0
pxor xmm0, xmm0
movdqu xmmword [ebx], xmm0
movdqu xmmword [ebx + 0x10], xmm0
movdqu xmmword [ebx + 0x20], xmm0
movdqu xmmword [ebx + 0x30], xmm0
mov eax, ecx
mov edi, dword [esp + 8]
or eax, edi
je 0x4442dd
lea eax, [esp + 0xc]
push 0xd9
push str.....operadesktopwindowsos_operationsos_operations_impl.cc
push str.NamedMutexImpl
push eax
mov dword [esp + 0x14], esi
mov esi, ecx
call fcn.004b4450
add esp, 0x10
mov ecx, ebx
push 0
lea eax, [esp + 0x10]
push eax
call fcn.004be2f0
mov byte [esp + 0x30], 1
not esi
xor edi, 0x7fffffff
or edi, esi
mov esi, dword [esp + 4]
jne 0x4442dd
xor eax, eax
dec eax
jmp 0x4442e6
lea ecx, [esp + 0x28]
call fcn.004be880
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
mov eax, dword [esp]
sete byte [eax + 8]
cmp byte [esp + 0x30], 0
je 0x444308
mov ecx, ebx
call fcn.004be370
mov esi, dword [ebp + 8]
mov eax, dword [esp]
mov dword [esi], eax
mov ecx, dword [esp + 0x88]
xor ecx, ebp
call fcn.004ed092
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x444ad0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, ecx
mov eax, dword [0x59d024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, 0x104
lea esi, [ebp - 0x20]
mov dword [esi], eax
lea ebx, [ecx + 0x18]
push eax
push ebx
call fcn.0047e760
add esp, 8
mov ecx, dword [edi + 0x24]
mov edx, dword [edi + 0x3c]
sub esp, 0x20
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc dword [edi + 0x3c]
test eax, eax
je 0x444b52
add edi, 0x30
mov ecx, edi
call fcn.0053ff20
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ed092
mov eax, esi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x30], ebx
mov esi, dword [ebp + 8]
xor eax, eax
dec eax
lea ebx, [ebp - 0x2c]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
lea eax, [edi + 8]
push 0x586e96
push eax
push ebx
call fcn.0042bfd0
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x444b85
mov eax, dword [ebp - 0x28]
jmp 0x444b88
and eax, 0x7f
mov ecx, ebx
push 0
push eax
call fcn.004b20e0
movzx eax, byte [edi + 0x23]
test al, al
jns 0x444ba2
mov eax, dword [edi + 0x1c]
mov edx, dword [edi + 0x18]
jmp 0x444ba8
and eax, 0x7f
mov edx, dword [ebp - 0x30]
mov ecx, ebx
push eax
push edx
call fcn.004691c0
cmp byte [ebp - 0x21], 0
jns 0x444bba
mov ebx, dword [ebp - 0x2c]
push 0x28
call fcn.004eca5e
add esp, 4
mov edx, ebx
mov ebx, eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x1c]
push edx
call fcn.0051d070
mov eax, dword [edi + 4]
mov dword [ebx], fcn.00444750
mov dword [ebp - 0x34], eax
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x30]
mov dword [ebx + 8], eax
lea edi, [ebx + 0xc]
mov ecx, edi
call fcn.00479b70
mov dword [ebp - 0x38], ebx
lea ecx, [ebx + 0x18]
lea ebx, [ebp - 0x1c]
mov al, byte [ebx + 0xb]
test al, al
js 0x444c5e
mov edx, dword [ebp - 0x14]
mov dword [ecx + 8], edx
movsd xmm0, qword [ebp - 0x1c]
movsd qword [ecx], xmm0
mov edx, dword [ebp - 0x30]
test al, al
jns 0x444c1f
mov ebx, dword [ebp - 0x1c]
mov ecx, edi
push edx
push ebx
push dword [ebp - 0x34]
call fcn.0047fc80
mov edi, dword [ebp - 0x38]
mov dword [edi + 0x24], eax
cmp byte [ebp - 0x11], 0
jns 0x444c42
push dword [ebp - 0x1c]
call fcn.004eca8e
add esp, 4
mov dword [esi], edi
cmp byte [ebp - 0x21], 0
jns 0x444b3c
push dword [ebp - 0x2c]
call fcn.004eca8e
add esp, 4
jmp 0x444b3c
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.00468b90
mov al, byte [ebp - 0x11]
jmp 0x444c15
Function at 0x454a60
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov ebx, ecx
mov eax, dword [0x59d024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ecx], 0x5828f4
cmp byte [ecx + 0x1c], 0
je 0x454b32
push 0x4c
push str.....operadesktopwindowsinstaller_transactionsdelete_file_operation.cc
call fcn.004b44c0
add esp, 8
test eax, eax
jg 0x454b9c
lea esi, [ebx + 0x10]
push esi
call fcn.0047b410
add esp, 4
test al, al
jne 0x454ab8
push esi
call fcn.0053d6e0
add esp, 4
cmp byte [ebx + 0x1e], 0
je 0x454b57
xor eax, eax
dec eax
lea edi, [ebp - 0xb4]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [ebp - 0xc4], ebx
lea ecx, [ebx + 4]
push edi
call fcn.004b3580
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ebx, [ebp - 0xc0]
cmp byte [ebp - 0xa9], 0
mov eax, edi
jns 0x454aff
mov eax, dword [ebp - 0xb4]
push eax
call esi
test eax, eax
je 0x454b1f
mov ecx, edi
push ebx
call fcn.004b3580
mov ecx, edi
push ebx
call fcn.0046d000
mov ecx, ebx
call fcn.004b3560
jmp 0x454aee
lea ecx, [ebp - 0xb4]
call fcn.004b3560
mov ebx, dword [ebp - 0xc4]
jmp 0x454b57
cmp dword [ebx + 0x20], 0
je 0x454b57
lea esi, [ebx + 0x20]
mov ecx, dword [0x5a1e4c]
test ecx, ecx
jne 0x454b51
call fcn.0043f650
mov ecx, eax
mov dword [0x5a1e4c], eax
push esi
call fcn.00440340
mov edi, dword [ebx + 0x20]
mov dword [ebx + 0x20], 0
test edi, edi
je 0x454b75
mov ecx, edi
call fcn.00440f60
push edi
call fcn.004eca8e
add esp, 4
lea ecx, [ebx + 0x10]
call fcn.004b3560
add ebx, 4
mov ecx, ebx
call fcn.004b3560
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ed092
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
lea edi, [ebp - 0xb4]
mov ecx, edi
push 0xffffffffffffffff
push 0x25
push str.....operadesktopwindowsinstaller_transactionsdelete_file_operation.cc
call fcn.0046fcd0
lea eax, [ebp - 0xac]
push 0x12
push str.Actual_removal_of
push eax
call fcn.0051d150
add esp, 0xc
lea ecx, [ebx + 0x10]
push ecx
push eax
call fcn.004705d0
add esp, 8
mov ecx, edi
call fcn.00470110
jmp 0x454a9f
Function at 0x456d90
Capabilities:
Inspect section memory permissions

Disassembly:
loop 0x456d92
add byte [eax], al
and byte [ecx + 0x1065], al
add byte [eax + 0x3b184d8b], al
sal dword [esp + eax - 0x80], cl
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
cmp dword [ebp + 0x10], ebx
je 0x456dba
add ecx, eax
or byte [ecx], 4

Function at 0x456db0
Capabilities:
Contain obfuscated stackstrings
Inspect section memory permissions

Disassembly:
loop 0x456d92
add byte [eax], al
and byte [ecx + 0x1065], al
add byte [eax + 0x3b184d8b], al
sal dword [esp + eax - 0x80], cl
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
cmp dword [ebp + 0x10], ebx
je 0x456dba
add ecx, eax
or byte [ecx], 4

Function at 0x456e80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x354], 0
and byte [ebp - 0x353], 0
mov byte [ebp - 0x352], 0xda
and byte [ebp - 0x351], 0
Function at 0x45ef50
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, ecx
mov eax, dword [0x59d024]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ecx + 0x10]
mov ecx, dword [ecx + 8]
lea ebx, [ebp - 0x1c]
push dword [edi]
push ebx
call fcn.0046e230
mov ecx, dword [edi + 8]
push ebx
call fcn.0046d000
mov ecx, ebx
call fcn.004b3560
mov bl, byte [edi + 0xc]
push dword [edi + 8]
call fcn.0047b650
add esp, 4
test al, al
je 0x45f080
cmp byte [edi + 0xc], 0
je 0x45f093
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], 0xffffffff
mov esi, dword [0x5a1e4c]
test esi, esi
jne 0x45efc6
call fcn.0043f650
mov esi, eax
mov dword [0x5a1e4c], eax
push 8
call fcn.004eca5e
add esp, 4
mov dword [ebp - 0x1c], eax
lea ecx, [eax + 8]
mov dword [ebp - 0x14], ecx
mov dword [eax + 4], 0
mov dword [eax], 2
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 0x20]
mov ecx, esi
lea edx, [ebp - 0x1c]
push edx
push dword [edi + 8]
push eax
call fcn.004403f0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x45f00e
mov dword [ebp - 0x18], eax
push eax
call fcn.004eca8e
add esp, 4
cmp byte [ebp - 0x20], 0
mov esi, dword [ebp - 0x24]
je 0x45f16d
cmp byte [ebp - 0x1f], 0
je 0x45f066
mov dword [ebp - 0x1c], 0xffffffff
mov ecx, dword [0x5a1e4c]
test ecx, ecx
jne 0x45f03e
call fcn.0043f650
mov ecx, eax
mov dword [0x5a1e4c], eax
push 1
push dword [edi + 8]
lea eax, [ebp - 0x1c]
push eax
call fcn.00440c30
cmp byte [ebp - 0x1c], 0
je 0x45f16d
mov al, byte [ebp - 0x1b]
mov ebx, eax
xor bl, 1
test al, 1
jne 0x45f093
mov bh, bl
jmp 0x45f068
mov bh, 1
push dword [edi + 8]
call fcn.0047b410
add esp, 4
test al, al
je 0x45f16d
test bh, 1
je 0x45f093
push dword [edi + 8]
call fcn.0046ea90
add esp, 4
test al, al
je 0x45f16d
test bl, 1
je 0x45f12a
mov ecx, dword [0x5a1e4c]
test ecx, ecx
jne 0x45f0b2
call fcn.0043f650
mov ecx, eax
mov dword [0x5a1e4c], eax
push 1
push dword [edi + 8]
call fcn.0043fb00
test al, al
je 0x45f16d
mov dword [ebp - 0x24], esi
mov esi, dword [0x5a1e4c]
test esi, esi
jne 0x45f0dd
call fcn.0043f650
mov esi, eax
mov dword [0x5a1e4c], eax
push 8
call fcn.004eca5e
add esp, 4
mov dword [ebp - 0x1c], eax
lea ecx, [eax + 8]
mov dword [ebp - 0x14], ecx
mov dword [eax + 4], 0
mov dword [eax], 2
mov dword [ebp - 0x18], ecx
mov ecx, esi
lea eax, [ebp - 0x1c]
push eax
push dword [edi + 8]
call fcn.00440760
mov ebx, eax
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x45f123
mov dword [ebp - 0x18], eax
push eax
call fcn.004eca8e
add esp, 4
test bl, bl
mov esi, dword [ebp - 0x24]
je 0x45f16d
mov dword [ebp - 0x24], esp
push eax
sub esp, 8
mov ebx, esi
mov esi, esp
lea ecx, [esi + 8]
push ebx
call fcn.004b3fc0
mov eax, dword [edi + 4]
mov ecx, dword [edi + 8]
mov dword [esi], ecx
mov dword [esi + 4], eax
mov ecx, esi
mov esi, ebx
call fcn.0045f190
mov bl, 1
mov esp, dword [ebp - 0x24]
test al, al
jne 0x45f16f
mov eax, dword [edi + 8]
cmp byte [eax + 0xb], 0
jns 0x45f166
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor ebx, ebx
mov ecx, esi
call fcn.004b3f90
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ed092
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x46ab10
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [0x5a2dcc]
test ebx, ebx
jne 0x46ab92
push 0x28
call fcn.004eca5e
add esp, 4
mov esi, eax
xor edi, edi
mov dword [eax], edi
mov dword [eax + 4], edi
mov byte [eax + 8], 0
push 0xc
call fcn.004eca5e
add esp, 4
mov dword [esi + 0xc], eax
lea ecx, [eax + 0xc]
mov dword [esi + 0x14], ecx
test eax, eax
je 0x46ab9c
mov dword [eax + 4], edi
mov dword [eax], edi
mov dword [eax + 8], edi
mov dword [esi + 0x10], ecx
mov eax, esi
add eax, 0x1c
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x24], 1
mov dword [0x5a2dcc], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x46abb7
mov edi, eax
push eax
call fcn.00508f54
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.0046abc0
test ebx, ebx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
push str.null_pointer_given_to_construct_at
push str.__location___nullptr
push 0x23
push str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
push str._s:_d:_assertion__s_failed:__s
call fcn.0051d7e0
int3