joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4440e2
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d5da7
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x55c6c0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
call fcn.00405223
call fcn.0048b4c4
fld qword [0x53a620]
mov eax, dword [eax + 0xc]
push ecx
push ecx
fstp qword [esp]
push 0x1a7
push dword [edi + 0x20]
lea ecx, [edi + 0x26b0]
mov edx, eax
call fcn.0040b5ad
push 0x1c
pop ecx
push ecx
mov ebx, 0x99
mov eax, ebx
push eax
push ecx
mov dword [esp + 0x20], esp
mov esi, esp
push 0x520938
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.RESOURCESTRING
mov byte [edi + 0xe0], 1
call fcn.0040255d
and dword [esp + 0x3c], 0
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x52f288
call fcn.0040255d
or dword [esp + 0x40], 0xffffffff
push esi
call fcn.00406e18
push 0xc2
push 0xc1
lea esi, [edi + 0x74]
push 0xc0
call fcn.00401908
push 0x1c
pop eax
push eax
mov eax, ebx
push eax
push ecx
mov dword [esp + 0x24], esp
mov esi, esp
push 0x520938
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.RESOURCESTRING
mov byte [edi + 0x248], 1
call fcn.0040255d
push ecx
mov dword [esp + 0x40], 1
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.S9PT9_262
call fcn.0040255d
or dword [esp + 0x40], 0xffffffff
push esi
call fcn.00406e18
push 0xc2
push 0xc1
lea esi, [edi + 0x1dc]
push 0xc0
call fcn.00401908
push 0x1c
pop eax
push eax
mov eax, ebx
push eax
push ecx
mov byte [edi + 0x3b0], 1
mov esi, esp
mov dword [esp + 0x24], esp
push 0x520938
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.RESOURCESTRING
call fcn.0040255d
push ecx
mov dword [esp + 0x40], 2
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.S9PT9_263
call fcn.0040255d
or dword [esp + 0x40], 0xffffffff
push esi
call fcn.00406e18
push 0xc2
push 0xc1
lea esi, [edi + 0x344]
push 0xc0
call fcn.00401908
push 0x1c
pop eax
push eax
mov eax, ebx
push eax
push ecx
mov dword [esp + 0x24], esp
mov esi, esp
push 0x520938
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.RESOURCESTRING
mov byte [edi + 0x518], 1
call fcn.0040255d
push ecx
mov dword [esp + 0x40], 3
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.S9PT9_581
call fcn.0040255d
or dword [esp + 0x40], 0xffffffff
push esi
call fcn.00406e18
push 0xc2
push 0xc1
lea esi, [edi + 0x4ac]
push 0xc0
call fcn.00401908
push 1
push 0x1c
pop esi
push esi
push ebx
push 0x15
push esi
lea ecx, [edi + 0x74]
call fcn.0048b738
push 1
push esi
push ebx
push 0x15
push 0xbe
lea ecx, [edi + 0x1dc]
call fcn.0048b738
push 1
push esi
push ebx
push 0x15
push 0x160
lea ecx, [edi + 0x344]
call fcn.0048b738
push 1
push esi
push ebx
push 0x15
push 0x202
lea ecx, [edi + 0x4ac]
call fcn.0048b738
mov eax, edi
call fcn.00444380
lea ecx, [edi + 0x618]
push 5
mov dword [edi + 0x614], ecx
call fcn.0048b778
push 0
push 0xff
push 0x111
push dword [edi + 0x20]
mov byte [edi + 0x151], 1
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
inc eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44f600
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push 0x228
mov eax, 0x4d5b5d
call fcn.004ae269
call fcn.004600e5
cmp eax, 6
jb 0x44f633
cmp byte [ebp + 8], 0
je 0x44f629
call fcn.0044ea35
jmp 0x44f70b
call fcn.0044e85e
jmp 0x44f70b
lea eax, [ebp - 0x21c]
mov edi, SysReAllocStringLen
push eax
lea esi, [ebp - 0x234]
mov dword [ebp - 0x21c], edi
call fcn.0040ab14
and dword [ebp - 4], 0
push 1
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push edi
call fcn.0040ab30
test eax, eax
je 0x44f6f2
cmp byte [ebp + 8], 0
je 0x44f6d6
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.004adda0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edi, [ebp - 0x218]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x44f6a9
mov esi, str.__rem
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x218]
push eax
movsd dword es:[edi], dword [esi]
push str.APTUReminder
lea eax, [ebp - 0x234]
push eax
movsd dword es:[edi], dword [esi]
call fcn.0040abed
jmp 0x44f6e7
push str.APTUReminder
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea esi, [ebp - 0x234]
call fcn.0040ab8e
lea esi, [ebp - 0x234]
call fcn.0040ab8e
mov ecx, dword [ebp - 0x22c]
add ecx, 0xfffffff0
call fcn.00402883
xor eax, eax
inc eax
call fcn.004ae2ec
ret 4
Function at 0x4546d4
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d58b5
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push edi
mov eax, dword [0x55c6c0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, 0x1b4
push edi
push dword [0x56531c]
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
xor ebx, ebx
test eax, eax
jne 0x454725
push 0x64
mov dword [esi + 0xa9c], ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call fcn.0048961d
pop ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x38], ebx
cmp eax, ebx
je 0x454740
push eax
call fcn.00405240
jmp 0x454742
xor eax, eax
or dword [esp + 0x38], 0xffffffff
mov dword [esi + 0xa9c], eax
mov dword [eax + 0x150], 1
mov eax, dword [esi + 0xa9c]
mov edi, dword [esi + 0xab4]
mov dword [eax + 0x16c], edi
mov eax, dword [esi + 0xa9c]
mov edi, dword [esi + 0xab0]
mov dword [eax + 0x170], edi
mov eax, dword [esi + 0xa9c]
mov dword [eax + 0x168], 0xff
mov eax, dword [esi + 0xa9c]
mov ecx, 0xfe
mov dword [eax + 0x158], ecx
lea edx, [ecx - 0x3d]
mov dword [eax + 0x15c], edx
mov eax, dword [esi + 0xa9c]
mov dword [eax + 0x60], ebx
mov eax, dword [esi + 0xa9c]
mov dword [eax + 0x17c], ebx
lea eax, [esi + 0xaa0]
cmp dword [eax], 0xffffffff
jne 0x4547cb
cmp dword [eax + 4], 0xffffffff
je 0x4547e2
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [esi + 0xa9c]
mov dword [ecx + 0x160], edx
mov dword [ecx + 0x164], eax
mov eax, dword [esi + 0xa9c]
mov ecx, dword [eax + 0x160]
mov edx, dword [eax + 0x164]
mov dword [eax + 0x160], ecx
mov dword [eax + 0x164], edx
mov edi, dword [esi + 0xa9c]
push dword [0x5661c8]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x13c]
test eax, eax
je 0x454889
cmp dword [edi + 0x154], ebx
jne 0x454889
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax + 0x140]
jmp 0x454889
mov eax, dword [esi + 0xa9c]
cmp eax, ebx
jne 0x45483e
xor eax, eax
jmp 0x454841
mov eax, dword [eax + 0x20]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45489e
push 6
pop ecx
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x10], ebx
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
jmp 0x454879
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push ebx
push ebx
push ebx
lea eax, [esp + 0x20]
push eax
call edi
test eax, eax
jne 0x454863
push 0x1b4
push dword [esi + 0xa9c]
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x454830
mov al, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x454d40
Capabilities:
Check if file exists
Get common file path

Disassembly:
push 8
mov eax, 0x4cc714
call fcn.004ae200
call fcn.00457823
test al, al
je 0x454d5c
mov al, 1
jmp 0x454dee
push 0x208
xor ebx, ebx
push ebx
mov esi, 0x567b08
push esi
call fcn.004adda0
add esp, 0xc
call fcn.00461ea4
push esi
push ebx
push ebx
test al, al
je 0x454d82
push 0x2a
jmp 0x454d84
push 0x26
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push esi
lea ecx, [ebp - 0x10]
call fcn.0040255d
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Secure_Driver_Updater
mov dword [ebp - 4], ebx
call fcn.0040255d
lea ecx, [ebp - 0x10]
call fcn.00406d13
push dword [ebp - 0x10]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call esi
test eax, eax
je 0x454de1
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.sdu.exe
call fcn.0040255d
lea ecx, [ebp - 0x10]
call fcn.00406d13
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x454de1
mov bl, 1
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402883
mov al, bl
call fcn.004ae2d8
ret

Function at 0x454e31
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push ecx
mov ecx, esp
mov dword [ebp - 4], esp
push str.Check_for_Update_started
call fcn.0040255d
call fcn.0044e684
movzx eax, byte [0x5662db]
push eax
movzx eax, byte [0x5662da]
push eax
call fcn.0045fc87
add esp, 8
mov ecx, esp
mov dword [ebp - 4], esp
push str.Check_for_Update_Completed
mov esi, eax
call fcn.0040255d
call fcn.0044e684
cmp byte [0x5662da], 0
pop ecx
je 0x454e92
test esi, esi
je 0x454e97
mov esi, dword [0x566298]
call fcn.004546d4
xor eax, eax
pop esi
leave
ret
push ecx
mov ecx, esp
mov dword [ebp - 4], esp
push str.ExitProcess_:_No_Updates
call fcn.0040255d
call fcn.0044e684
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x457823
Capabilities:
Check if file exists
Get common file path

Disassembly:
push 8
mov eax, 0x4cc714
call fcn.004ae200
push 0x208
xor ebx, ebx
push ebx
mov esi, 0x567d18
push esi
call fcn.004adda0
add esp, 0xc
call fcn.00461ea4
push esi
push ebx
push ebx
test al, al
je 0x457855
push 0x2a
jmp 0x457857
push 0x26
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push esi
lea ecx, [ebp - 0x10]
call fcn.0040255d
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.PC_Suite_Plus
mov dword [ebp - 4], ebx
call fcn.0040255d
lea ecx, [ebp - 0x10]
call fcn.00406d13
push dword [ebp - 0x10]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call esi
test eax, eax
je 0x4578b4
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.pcsuiteplus.exe
call fcn.0040255d
lea ecx, [ebp - 0x10]
call fcn.00406d13
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x4578b4
mov bl, 1
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402883
mov al, bl
call fcn.004ae2d8
ret
Function at 0x45836b
Capabilities:
Check for time delay via gettickcount
Continue service
Modify service
Query service status
Start service

Disassembly:
push 0x34
mov eax, 0x4d0b72
call fcn.004ae200
lea edi, [ebp - 0x20]
call fcn.00458225
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x20], ebx
je 0x4584cb
mov edi, dword [ebp - 0x1c]
cmp edi, ebx
je 0x4584d5
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x3c]
push eax
push edi
call esi
test eax, eax
jne 0x4583c6
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 0x20]
call esi
mov al, bl
jmp 0x4584e1
mov eax, dword [ebp - 0x38]
dec eax
je 0x4583f6
sub eax, 3
je 0x4583f2
sub eax, 3
jne 0x4583af
lea eax, [ebp - 0x3c]
push eax
push 3
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x4583af
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov bl, 1
jmp 0x4583af
call fcn.0048b4c4
mov ecx, dword [eax + 4]
call fcn.00491ca6
push ebx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
cmp eax, 0x420
jne 0x458420
lea ecx, [ebp - 0xd]
mov byte [ebp - 4], bl
call fcn.00421054
jmp 0x4583f2
cmp eax, ebx
jge 0x458434
lea ecx, [ebp - 0xd]
mov byte [ebp - 4], bl
call fcn.00421054
jmp 0x4583af
lea eax, [ebp - 0x3c]
push eax
push edi
call esi
test eax, eax
je 0x458424
cmp byte [ebp - 0x18], bl
jne 0x458458
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov edi, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
jmp 0x4584b6
mov eax, dword [ebp - 0x24]
push 0xa
xor edx, edx
pop ecx
div ecx
mov ecx, 0x1f4
cmp eax, ecx
jb 0x458484
mov ecx, 0x1388
cmp eax, ecx
jbe 0x458486
mov eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x458424
cmp dword [ebp - 0x28], edi
ja 0x45845e
call esi
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x24]
jbe 0x4584b6
cmp dword [ebp - 0x24], ebx
ja 0x458424
cmp dword [ebp - 0x38], 2
je 0x458468
cmp dword [ebp - 0x38], 4
jne 0x458424
jmp 0x458413
cmp dword [ebp - 0x1c], ebx
je 0x4584d5
push dword [ebp - 0x1c]
call esi
cmp dword [ebp - 0x20], ebx
je 0x4584df
push dword [ebp - 0x20]
call esi
xor al, al
call fcn.004ae2d8
ret
Function at 0x4598c0
Capabilities:
Check if file exists

Disassembly:
push 0xcdc
mov eax, 0x4ce394
call fcn.004ae29f
mov edi, ecx
lea esi, [edi + 0x20]
push esi
mov dword [ebp - 0xc88], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp byte [edi], bl
jne 0x4598f0
push esi
jmp 0x4599c9
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 1
mov eax, dword [edi + 0x38]
push ecx
push eax
mov dword [ebp - 0x450], ebx
mov dword [ebp - 0x44c], ebx
mov dword [ebp - 0x448], ebx
mov dword [ebp - 0x444], ebx
mov dword [ebp - 0x440], ebx
mov dword [ebp - 0x43c], ebx
call fcn.004973d6
cmp eax, ebx
je 0x4598ea
mov esi, 0x82c
push esi
lea eax, [ebp - 0xc80]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004adda0
mov eax, dword [edi + 0x38]
add esp, 0xc
cmp eax, ebx
je 0x459958
push eax
lea eax, [ebp - 0xc80]
call fcn.0040c7ea
lea eax, [ebp - 0xa6e]
push eax
lea ecx, [ebp - 0xc8c]
mov byte [ebp - 4], 3
call fcn.0040255d
push 0x208
lea eax, [ebp - 0x220]
push ebx
push eax
mov byte [ebp - 4], 4
call fcn.004adda0
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
call fcn.00461f0d
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4599d5
mov ecx, dword [ebp - 0xc8c]
add ecx, 0xfffffff0
call fcn.00402883
push esi
lea eax, [ebp - 0xc80]
push ebx
push eax
call fcn.004adda0
add esp, 0xc
push dword [ebp - 0xc88]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.004ae2fb
ret
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0xc84]
call fcn.0040255d
push ecx
mov byte [ebp - 4], 5
lea eax, [ebp - 0xc8c]
mov dword [ebp - 0xc90], esp
mov ecx, esp
push eax
call fcn.004025a1
lea ecx, [ebp - 0xc84]
call fcn.00406d13
push str..dat
lea eax, [ebp - 0xc84]
push eax
lea eax, [ebp - 0xc90]
push eax
call fcn.004021ba
add esp, 0xc
push eax
lea ecx, [ebp - 0xc84]
mov byte [ebp - 4], 6
call fcn.0040262c
mov ecx, dword [ebp - 0xc90]
add ecx, 0xfffffff0
call fcn.00402883
lea ecx, [ebp - 0xca0]
mov byte [ebp - 4], 7
call fcn.0049938c
push ebx
push 0x9001
mov byte [ebp - 4], 8
push dword [ebp - 0xc84]
lea ecx, [ebp - 0xca0]
call fcn.00499811
cmp eax, ebx
je 0x459b26
push ebx
push 0x1000
push ebx
lea eax, [ebp - 0xca0]
push eax
lea ecx, [ebp - 0xce8]
mov byte [ebp - 4], 9
call fcn.004989aa
lea eax, [edi + 0x38]
push eax
lea ecx, [ebp - 0xce8]
mov byte [ebp - 4], 0xa
call fcn.00415530
push dword [ebp - 0x434]
lea ecx, [ebp - 0xce8]
push dword [ebp - 0x438]
call fcn.00459f50
push dword [ebp - 0x444]
lea eax, [ebp - 0xce8]
push dword [ebp - 0x448]
push eax
call fcn.0049ba44
lea ecx, [edi + 4]
mov eax, dword [ecx]
lea edx, [ebp - 0xce8]
push edx
call dword [eax + 8]
lea ecx, [ebp - 0xce8]
call fcn.004987f3
lea ecx, [ebp - 0xce8]
mov byte [ebp - 4], 9
call fcn.0049896c
mov dword [ebp - 4], 8
jmp 0x459b1b
lea ecx, [ebp - 0xca0]
call fcn.00499326
lea ecx, [ebp - 0xca0]
mov byte [ebp - 4], 7
call fcn.004994a5
mov ecx, dword [ebp - 0xc84]
add ecx, 0xfffffff0
call fcn.00402883
jmp 0x4599a4
Function at 0x45a93f
Capabilities:
Check if file exists
Create process on windows
Terminate process

Disassembly:
push 0x14
mov eax, 0x4d0991
call fcn.004ae200
mov esi, 0x532990
push esi
lea ecx, [ebp - 0x1c]
call fcn.0040c6fa
mov edi, eax
and dword [ebp - 4], 0
push esi
lea ecx, [ebp - 0x18]
call fcn.0040c6fa
push 0x566660
push eax
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 1
call fcn.00402163
push edi
push eax
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 2
call fcn.00402163
add esp, 0x18
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00402883
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402883
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00402883
push dword [0x566660]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45aa01
push 1
push 0x520938
push 0x531e8c
push dword [ebp - 0x10]
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x532994
call fcn.0040255d
call fcn.0044e684
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402883
call fcn.004ae2d8
ret

Function at 0x45aa12
Capabilities:
Delete file

Disassembly:
push 0x190
mov eax, 0x4cacfc
call fcn.004ae233
and dword [ebp - 4], 0
mov al, byte [0x567f21]
test al, al
jne 0x45ab7b
call fcn.0045a00c
test eax, eax
je 0x45ab7b
push dword [ebp + 8]
mov byte [0x567f21], 1
call fcn.00407091
test al, al
je 0x45aa5b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 1
call fcn.00459ff9
push 3
push dword [ebp + 8]
lea eax, [ebp - 0x90]
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0x94]
push eax
call fcn.0040727b
push 3
mov byte [ebp - 4], 2
push dword [0x566658]
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x118]
push eax
call fcn.0040727b
mov byte [ebp - 4], 3
push dword [ebp - 0x94]
push dword [ebp - 0x118]
call fcn.00459fc7
lea eax, [ebp - 0x114]
pop ecx
pop ecx
cmp dword [ebp - 0x118], eax
je 0x45aad6
push dword [ebp - 0x118]
call fcn.004aa7c7
pop ecx
lea eax, [ebp - 0x90]
mov byte [ebp - 4], 1
cmp dword [ebp - 0x94], eax
je 0x45aaf4
push dword [ebp - 0x94]
call fcn.004aa7c7
pop ecx
push str.true
push str.hidden
call fcn.0045a01f
pop ecx
pop ecx
push dword [0x566304]
call fcn.00407091
test al, al
je 0x45ab68
push 3
push dword [0x566304]
lea eax, [ebp - 0x198]
mov dword [ebp - 0x19c], eax
lea eax, [ebp - 0x19c]
push eax
call fcn.0040727b
mov byte [ebp - 4], 4
push dword [ebp - 0x19c]
push str.language
call fcn.0045a01f
lea eax, [ebp - 0x198]
pop ecx
mov byte [ebp - 4], 1
pop ecx
cmp dword [ebp - 0x19c], eax
je 0x45ab68
push dword [ebp - 0x19c]
call fcn.004aa7c7
pop ecx
mov byte [0x567f21], 1
call fcn.00459fe3
mov byte [0x567f21], 0
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00402883
call fcn.004ae2d8
ret
Function at 0x460129
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x55c6c0]
xor eax, ebp
mov dword [ebp + 0x190], eax
and dword [ebp - 0x7c], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x78], ax
lea eax, [ebp - 0x76]
push eax
call fcn.004adda0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [ebp - 0x7c]
push dword [ebp - 0x80]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x78]
push eax
mov ecx, esi
call fcn.0040255d
mov ecx, dword [ebp + 0x190]
xor ecx, ebp
mov eax, esi
call fcn.004aa206
add ebp, 0x194
leave
ret

Function at 0x4601bc
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x55c6c0]
xor eax, ebp
mov dword [ebp + 0x190], eax
and dword [ebp - 0x7c], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x78], ax
lea eax, [ebp - 0x76]
push eax
call fcn.004adda0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
push 0x19
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [ebp - 0x7c]
push dword [ebp - 0x80]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x78]
push eax
mov ecx, esi
call fcn.0040255d
mov ecx, dword [ebp + 0x190]
xor ecx, ebp
mov eax, esi
call fcn.004aa206
add ebp, 0x194
leave
ret
Function at 0x4602b5
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0xc
mov eax, 0x4d079a
call fcn.004ae200
lea esi, [ebp - 0x10]
call fcn.00460129
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [0x566394], ebx
jne 0x460316
push ecx
mov dword [ebp - 0x14], esp
mov esi, esp
push 0x520938
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.RESOURCESTRING
call fcn.0040255d
push ecx
mov byte [ebp - 4], 1
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.S9PT9_42
call fcn.0040255d
push esi
mov byte [ebp - 4], bl
call fcn.00406e18
lea ecx, [ebp - 0x10]
call fcn.00406d13
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x80
push dword [ebp - 0x10]
call edi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x10]
call fcn.0040268b
lea esi, [ebp - 0x14]
call fcn.004601bc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.0040262c
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00402883
cmp dword [0x566394], ebx
jne 0x4603a2
push ecx
mov dword [ebp - 0x18], esp
mov esi, esp
push 0x520938
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.RESOURCESTRING
call fcn.0040255d
push ecx
mov byte [ebp - 4], 3
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.S9PT9_42
call fcn.0040255d
push esi
mov byte [ebp - 4], bl
call fcn.00406e18
lea ecx, [ebp - 0x10]
call fcn.00406d13
push 0x80
push dword [ebp - 0x10]
call edi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push ebx
push ebx
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
call fcn.0046024f
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402883
call fcn.004ae2d8
ret
Function at 0x4668f6
Capabilities:
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x55c6c0]
xor eax, ebp
mov dword [ebp + 0x190], eax
push ebx
push esi
mov esi, ecx
push edi
push esi
mov ecx, 0x568410
mov dword [0x56840c], 0x1000
call fcn.0040276b
mov eax, esi
push 2
lea edx, [eax + 2]
pop edi
xor ebx, ebx
mov cx, word [eax]
add eax, edi
cmp cx, bx
jne 0x466935
sub eax, edx
sar eax, 1
cmp eax, 3
jbe 0x4669ba
cmp word [esi + 2], 0x3a
je 0x4669ba
push 0x104
lea eax, [ebp - 0x7c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x7c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, edi
cmp cx, bx
jne 0x466965
sub eax, edx
sar eax, 1
lea ecx, [ebp + eax*2 - 0x7e]
je 0x466986
sub ecx, edi
dec eax
cmp word [ecx], 0x5c
je 0x46698c
cmp eax, ebx
jne 0x466979
cmp word [ecx], 0x5c
jne 0x4669a3
lea edx, [ecx + 2]
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, edi
cmp cx, bx
jne 0x466993
jmp 0x4669cf
lea edx, [ebp - 0x7c]
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, edi
cmp cx, bx
jne 0x4669aa
jmp 0x4669cf
lea edx, [ebp - 0x7c]
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, edi
cmp cx, bx
jne 0x4669c1
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4669ff
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsNetworkPathW]
test eax, eax
jne 0x4669ff
push ecx
lea eax, [ebp - 0x7c]
mov ecx, esp
mov dword [ebp - 0x80], esp
push eax
call fcn.0040255d
call fcn.00466a9c
push ebx
push 0x8b041
lea eax, [ebp - 0x7c]
push eax
mov eax, dword [0x5683f8]
mov esi, 0x5683f8
mov ecx, esi
call dword [eax + 0x20]
test eax, eax
je 0x466a32
mov eax, dword [0x5683f8]
push edi
push ebx
push ebx
mov ecx, esi
mov byte [0x568408], 1
call dword [eax + 0x28]
jmp 0x466a38
mov byte [0x568408], bl
push 0x5683dc
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [ebp + 0x190]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aa206
add ebp, 0x194
leave
ret