joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e2f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x50d0ed
mov eax, dword fs:[0]
push eax
sub esp, 0xec
push ebp
push esi
push edi
mov eax, dword [0x53f5a0]
xor eax, esp
push eax
lea eax, [esp + 0xfc]
mov dword fs:[0], eax
mov esi, ecx
mov ebp, dword [esp + 0x10c]
lea eax, [esp + 0x14]
push eax
call fcn.0042dc50
mov dword [esp + 0x104], 0
cmp dword [esi + 4], 0
je 0x42e3d4
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x42e353
mov eax, dword [esi + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42e3d4
shr eax, 4
not al
and al, 1
je 0x42e3d4
cmp byte [esi + 0x11c], 0
je 0x42e379
add esi, 0xc
jmp 0x42e37c
mov esi, dword [esi + 8]
add esi, 4
push esi
lea edi, [esp + 0x18]
call fcn.0043f0a0
test al, al
jne 0x42e39b
mov ecx, ebp
call fcn.00438300
push 0x527c8c
jmp 0x42e3e0
lea ecx, [esp + 0x14]
call fcn.0042dce0
test al, al
jne 0x42e3bb
push 0x527ca8
mov ecx, ebp
call fcn.00402790
lea edx, [esp + 0x14]
push edx
jmp 0x42e3f4
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x108], 0xffffffff
call fcn.0042e430
mov al, 1
jmp 0x42e406
mov ecx, ebp
call fcn.00438300
push 0x527c70
push 0x51f1f4
mov edx, eax
call fcn.00439710
add esp, 8
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x108], 0xffffffff
call fcn.0042e430
xor al, al
mov ecx, dword [esp + 0xfc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0xf8
ret 4

Function at 0x42e680
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x508658
mov eax, dword fs:[0]
push eax
mov eax, dword [0x53f5a0]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov byte [eax + 4], cl
mov dword [eax + 8], str.item
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], fcn.004cc39d
mov dword [eax + 0x24], fcn.004ce4c2
mov dword [eax + 0x28], fcn.004cc2c0
mov dword [eax + 0x2c], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax], vtable.n_config::t_arraySection_class_t_PicFaceConfigFile::t_item_.0
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 8

Function at 0x430440
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x508658
mov eax, dword fs:[0]
push eax
mov eax, dword [0x53f5a0]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov byte [eax + 4], cl
mov dword [eax + 8], 0x527f58
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], fcn.004cc39d
mov dword [eax + 0x24], fcn.004ce4c2
mov dword [eax + 0x28], fcn.004cc2c0
mov dword [eax + 0x2c], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax], vtable.n_config::t_arraySection_class_t_configTipListFile::t_recommend_.0
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 8
Function at 0x4307f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x508658
mov eax, dword fs:[0]
push eax
mov eax, dword [0x53f5a0]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov byte [eax + 4], cl
mov dword [eax + 8], str.cellmap
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], fcn.004cc39d
mov dword [eax + 0x24], fcn.004ce4c2
mov dword [eax + 0x28], fcn.004cc2c0
mov dword [eax + 0x2c], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax], vtable.n_config::t_arraySection_class_t_configTipListFile::t_fixedCellItem_.0
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 8

Function at 0x430c30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5084d9
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x53f5a0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push fcn.00451a00
push 0x430bf0
push 0xc8
push 0x10
lea eax, [esi + 0x34]
push eax
call fcn.004d0876
push fcn.00451a00
push 0x430c10
push 0x7d0
push 0xc
lea ecx, [esi + 0xcb8]
xor edi, edi
push ecx
mov dword [esp + 0x28], edi
call fcn.004d0876
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0xcb4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], 0xffffffff
mov dword [esi + 0x6a78], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x431010
Capabilities:
Create http request

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 4]
test eax, eax
je 0x431028
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [esi + 4], 0
mov eax, dword [esp + 8]
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 4], eax
test eax, eax
jne 0x43107b
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, ebx
mov edi, eax
call fcn.00438300
mov esi, eax
call fcn.00438b40
mov ecx, ebx
call fcn.00438300
push 0x52820c
push 0x51f1f4
mov edx, eax
call fcn.00439710
add esp, 8
pop edi
xor al, al
pop esi
ret 4
mov al, 1
pop esi
ret 4
Function at 0x431090
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, ecx
cmp dword [esi + 4], 0
push edi
mov edi, eax
mov dword [esi], 0x4e20
jne 0x4310cc
mov ecx, dword [esp + 0x10]
call fcn.00438300
push 0x520164
push 0x51f1f4
mov edx, eax
call fcn.00439710
add esp, 8
pop edi
pop esi
xor al, al
pop ebp
ret 0x1c
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
push ebx
mov ebx, dword [sym.imp.WININET.dll_InternetCloseHandle]
test eax, eax
je 0x4310ea
push eax
call ebx
mov ecx, dword [esp + 0x18]
mov dword [ecx], 0
mov eax, dword [edi]
test eax, eax
je 0x4310f9
push eax
call ebx
mov dword [edi], 0
movzx ecx, word [esi + 0x208]
or ebp, 0x84480100
cmp byte [esp + 0x28], 0
movzx eax, cx
je 0x431119
movzx eax, cx
or ebp, 0x803000
mov edx, dword [esp + 0x1c]
push 0
push 0
push 3
push 0x51f23c
push 0x51f23c
push eax
mov eax, dword [esi + 4]
push edx
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [edi], eax
test eax, eax
jne 0x43116a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [esp + 0x14]
mov ecx, ebx
mov edi, eax
call fcn.00438300
mov esi, eax
call fcn.00438b40
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, ebx
call fcn.00438300
jmp 0x4311b4
mov ebx, dword [esp + 0x14]
mov eax, edi
mov ecx, ebx
call fcn.00431200
test al, al
jne 0x431189
mov ecx, ebx
call fcn.00438300
push 0x528220
jmp 0x4311b9
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov eax, dword [edi]
push 0
push ebp
push 0
push 0
push 0
push ecx
push edx
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
test eax, eax
jne 0x4311d1
call fcn.00438b10
push 0x52820c
push 0x51f1f4
mov edx, eax
call fcn.00439710
add esp, 8
pop ebx
pop edi
pop esi
xor al, al
pop ebp
ret 0x1c
mov eax, ecx
mov ecx, ebx
call fcn.00431200
test al, al
jne 0x4311f3
push 0x528220
mov ecx, ebx
call fcn.00402790
pop ebx
pop edi
pop esi
xor al, al
pop ebp
ret 0x1c
pop ebx
pop edi
pop esi
mov al, 1
pop ebp
ret 0x1c
Function at 0x431780
Capabilities:
Send data

Disassembly:
push 0xffffffffffffffff
push 0x5097e8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53f5a0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov ebp, dword [esp + 0x3c]
xor ebx, ebx
push 8
mov dword [esp + 0x40], ebx
call fcn.004cf9e8
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x4317d3
push ebx
call fcn.004cf68f
add esp, 4
mov dword [esi], eax
mov dword [esi + 4], edx
mov ebx, esi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x28], 0
test edi, edi
jbe 0x43182a
mov esi, dword [sym.imp.WININET.dll_InternetWriteFile]
lea esp, [esp]
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x3c]
push eax
push edi
push ebp
push ecx
call esi
test eax, eax
je 0x43184b
push 0
call fcn.004cf68f
sub eax, dword [ebx]
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x34]
imul eax, eax, 0x3e8
add esp, 4
cmp eax, dword [edx]
ja 0x431892
mov eax, dword [esp + 0x3c]
add ebp, eax
sub edi, eax
jne 0x4317f0
push ebx
call fcn.004ce6dd
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [esp + 0x34]
mov ecx, ebp
mov edi, eax
call fcn.00438300
mov esi, eax
call fcn.00438b40
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, ebp
call fcn.00438300
push 0x52826c
push 0x51f1f4
mov edx, eax
call fcn.00439710
push ebx
call fcn.004ce6dd
add esp, 0xc
xor al, al
jmp 0x431835
mov ecx, dword [esp + 0x34]
call fcn.00438300
push 0x528280
jmp 0x431879
Function at 0x4318b0
Capabilities:
Read data from internet
Receive data

Disassembly:
push 0xffffffffffffffff
push 0x5097e8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53f5a0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
mov esi, dword [eax]
xor ebx, ebx
push 8
mov dword [esp + 0x40], ebx
call fcn.004cf9e8
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x431907
push ebx
call fcn.004cf68f
add esp, 4
mov dword [edi], eax
mov dword [edi + 4], edx
mov ebx, edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x28], 0
test esi, esi
jle 0x431960
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
lea ecx, [ecx]
mov edx, dword [esp + 0x38]
lea ecx, [esp + 0x3c]
push ecx
push esi
push ebp
push edx
call edi
test eax, eax
je 0x431987
push 0
call fcn.004cf68f
sub eax, dword [ebx]
mov ecx, dword [esp + 0x34]
imul eax, eax, 0x3e8
add esp, 4
mov dword [esp + 0x1c], edx
cmp eax, dword [ecx]
ja 0x4319ce
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x431960
sub esi, eax
add ebp, eax
test esi, esi
jg 0x431920
mov eax, dword [esp + 0x40]
sub dword [eax], esi
push ebx
call fcn.004ce6dd
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [esp + 0x34]
mov ecx, ebp
mov edi, eax
call fcn.00438300
mov esi, eax
call fcn.00438b40
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, ebp
call fcn.00438300
push 0x528298
push 0x51f1f4
mov edx, eax
call fcn.00439710
push ebx
call fcn.004ce6dd
add esp, 0xc
xor al, al
jmp 0x431971
mov ecx, dword [esp + 0x34]
call fcn.00438300
push 0x5282ac
jmp 0x4319b5

Function at 0x432820
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x50bffd
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x53f5a0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x28]
fld dword [0x52ecac]
sub esp, 0xc
fstp dword [esp + 8]
lea esi, [edi + 0x804]
fld dword [0x52eca8]
lea eax, [esp + 0x18]
fstp dword [esp + 4]
mov dword [esp + 0x18], fcn.004cc39d
fld dword [0x52eca4]
mov dword [esp + 0x1c], fcn.004ce4c2
fstp dword [esp]
mov dword [esp + 0x20], fcn.004cc2c0
call fcn.00408010
mov dword [esp + 0x20], 0
fld dword [0x52ecac]
sub esp, 0xc
fstp dword [esp + 8]
lea esi, [edi + 0x840]
fld dword [0x52eca8]
lea eax, [esp + 0x18]
fstp dword [esp + 4]
mov dword [esp + 0x18], fcn.004cc39d
fld dword [0x52eca4]
mov dword [esp + 0x1c], fcn.004ce4c2
fstp dword [esp]
mov dword [esp + 0x20], fcn.004cc2c0
call fcn.00408010
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x30]
push ecx
mov dword [edi + 0x890], eax
mov eax, dword [esp + 0x30]
push edx
push eax
mov eax, dword [esp + 0x48]
mov ecx, edi
mov dword [edi + 0x88c], 0
call fcn.004327b0
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret 0x18
Function at 0x436580
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp byte [ecx + 0x11c], 0
lea eax, [ecx + 0xc]
jne 0x43658f
mov eax, dword [ecx + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4365a1
xor al, al
ret
shr eax, 4
not eax
and eax, 1
ret
Function at 0x436f40
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x50a157
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x53f5a0]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push esi
mov eax, dword [0x53f5a0]
xor eax, esp
push eax
lea eax, [esp + 0x258]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x268]
mov esi, ecx
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x436f91
mov eax, dword [esi + 8]
push 2
add eax, 4
push 0x51f21c
push eax
call fcn.004cd1c2
add esp, 0xc
test eax, eax
je 0x437194
mov ecx, esi
call fcn.004365b0
test al, al
je 0x43703f
cmp byte [esp + 0x26c], 0
je 0x437194
cmp byte [esi + 0x11c], 0
je 0x436fd7
add esi, 0xc
jmp 0x436fda
mov esi, dword [esi + 8]
lea ecx, [esp + 0xc]
call fcn.00438f20
lea eax, [esi + 4]
lea edx, [esp + 0xc]
call fcn.00439130
push 0x528b18
mov ecx, ebx
mov dword [esp + 0x264], 1
call fcn.00438300
mov esi, eax
lea eax, [esp + 0x10]
call fcn.00438d10
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], vtable.t_str.0
jne 0x437038
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x437038
push eax
call fcn.004cc2c0
add esp, 4
xor al, al
jmp 0x437196
lea ecx, [esp + 0x130]
call fcn.00435d60
lea edx, [esp + 0x130]
push edx
mov ecx, esi
mov dword [esp + 0x264], 2
call fcn.004379e0
test al, al
je 0x43709f
lea eax, [esp + 0x130]
call fcn.00436330
test al, al
jne 0x43709f
push 0
push ebx
lea ecx, [esp + 0x138]
call fcn.00436f40
test al, al
jne 0x43709f
lea ecx, [esp + 0x130]
call fcn.00439080
xor al, al
jmp 0x437196
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x4370ae
mov eax, dword [esi + 8]
push 0
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x437156
cmp byte [esi + 0x11c], al
je 0x4370cf
add esi, 0xc
jmp 0x4370d2
mov esi, dword [esi + 8]
lea ecx, [esp + 0xc]
call fcn.00438f20
lea eax, [esi + 4]
lea edx, [esp + 0xc]
call fcn.00439130
push 0x521518
mov byte [esp + 0x264], 4
call fcn.00438b10
mov esi, eax
lea eax, [esp + 0x10]
call fcn.00438d10
cmp byte [esp + 0x128], 0
mov esi, vtable.t_str.0
mov dword [esp + 0xc], esi
jne 0x43712c
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x43712c
push eax
call fcn.004cc2c0
add esp, 4
cmp byte [esp + 0x24c], 0
mov dword [esp + 0x130], esi
jne 0x437038
mov eax, dword [esp + 0x138]
lea edx, [esp + 0x13c]
cmp eax, edx
jmp 0x43702d
mov eax, esi
call fcn.00437c80
mov eax, esi
call fcn.00437b10
cmp byte [esp + 0x24c], 0
mov dword [esp + method.t_str.virtual_0], vtable.t_str.0
jne 0x437194
mov eax, dword [esp + 0x138]
lea ecx, [esp + 0x13c]
cmp eax, ecx
je 0x437194
push eax
call fcn.004cc2c0
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.004cc2b1
add esp, 0x258
ret 8
Function at 0x4380e0
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x50e18c
mov eax, dword fs:[0]
push eax
sub esp, 0x248
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53f5a0]
xor eax, esp
push eax
lea eax, [esp + 0x25c]
mov dword fs:[0], eax
mov ebx, ecx
mov ebp, dword [esp + 0x26c]
call fcn.00436a20
cmp byte [ebx + 0x11c], 0
lea ecx, [ebx + 0xc]
jne 0x43812a
mov ecx, dword [ebx + 8]
cmp byte [ebp + 0x11c], 0
lea eax, [ebp + 0xc]
jne 0x438139
mov eax, dword [ebp + 8]
push 2
add ecx, 4
push ecx
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x438270
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x270]
mov edi, eax
call fcn.00438300
mov esi, eax
call fcn.00438b40
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [esp + 0x270]
mov ecx, edi
call fcn.00438300
push str.MoveFileEx
push 0x51f1f4
mov edx, eax
call fcn.00439710
add esp, 8
cmp byte [ebx + 0x11c], 0
je 0x4381a4
add ebx, 0xc
jmp 0x4381a7
mov ebx, dword [ebx + 8]
lea ecx, [esp + 0x138]
call fcn.00438f20
lea eax, [ebx + 4]
lea edx, [esp + 0x138]
call fcn.00439130
mov dword [esp + 0x264], 5
cmp byte [ebp + 0x11c], 0
lea esi, [ebp + 0xc]
jne 0x4381dc
mov esi, dword [ebp + 8]
lea ecx, [esp + 0x14]
call fcn.00438f20
lea eax, [esi + 4]
lea edx, [esp + 0x14]
call fcn.00439130
lea eax, [esp + 0x14]
push eax
push str._rY6R
mov ecx, edi
mov byte [esp + 0x26c], 7
call fcn.00438300
mov esi, eax
lea eax, [esp + 0x140]
call fcn.00438dc0
cmp byte [esp + 0x130], 0
mov esi, vtable.t_str.0
mov dword [esp + 0x14], esi
jne 0x438240
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
cmp eax, ecx
je 0x438240
push eax
call fcn.004cc2c0
add esp, 4
cmp byte [esp + 0x254], 0
mov dword [esp + 0x138], esi
jne 0x43826c
mov eax, dword [esp + 0x140]
lea edx, [esp + 0x144]
cmp eax, edx
je 0x43826c
push eax
call fcn.004cc2c0
add esp, 4
xor al, al
jmp 0x438272
mov al, 1
mov ecx, dword [esp + 0x25c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret 8
Function at 0x439e30
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
sub esp, 0x804
mov eax, dword [0x53f5a0]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
mov esi, dword [esp + 0x80c]
push 0x54a250
push esi
call fcn.004cc568
add esp, 8
test eax, eax
je 0x439e76
xor eax, eax
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004cc2b1
add esp, 0x804
ret
mov eax, 0x4000
test word [0x54a256], ax
je 0x439f96
push edi
push esi
push str._s.
lea edx, [esp + 0x10]
call fcn.004023b0
add esp, 8
push 0x54a000
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x439f95
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea ecx, [ecx]
mov ecx, 0x51f1cc
mov eax, 0x54a02c
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x439ef6
test dx, dx
je 0x439ef2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x439ef6
add eax, 4
add ecx, 4
test dx, dx
jne 0x439ed0
xor eax, eax
jmp 0x439efb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x439f7d
mov ecx, 0x51f1d0
mov eax, 0x54a02c
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x439f36
test dx, dx
je 0x439f32
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x439f36
add eax, 4
add ecx, 4
test dx, dx
jne 0x439f10
xor eax, eax
jmp 0x439f3b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x439f7d
push 0x54a02c
push esi
push str._s_s
lea edx, [esp + 0x18]
call fcn.004023b0
add esp, 0xc
test byte [0x54a000], 0x10
je 0x439f6e
lea edx, [esp + 0xc]
push edx
call fcn.00439e30
add esp, 4
jmp 0x439f7d
push 4
push 0
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0x54a000
push edi
call ebp
test eax, eax
jne 0x439ec0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
pop edi
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [esp + 0x804]
pop esi
xor ecx, esp
call fcn.004cc2b1
add esp, 0x804
ret
Function at 0x439fd0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x804
mov eax, dword [0x53f5a0]
xor eax, esp
mov dword [esp + 0x800], eax
push ebp
push esi
mov esi, dword [esp + 0x810]
push 0x549fd0
push esi
xor ebp, ebp
call fcn.004cc568
add esp, 8
test eax, eax
je 0x43a01a
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004cc2b1
add esp, 0x804
ret
mov eax, 0x4000
test word [0x549fd6], ax
je 0x43a12e
push edi
push esi
push str._s.
lea edx, [esp + 0x14]
call fcn.004023b0
add esp, 8
push 0x549d80
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x43a11a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ecx, 0x51f1cc
mov eax, 0x549dac
jmp 0x43a070
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43a096
test dx, dx
je 0x43a092
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43a096
add eax, 4
add ecx, 4
test dx, dx
jne 0x43a070
xor eax, eax
jmp 0x43a09b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x43a102
mov ecx, 0x51f1d0
mov eax, 0x549dac
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43a0d6
test dx, dx
je 0x43a0d2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43a0d6
add eax, 4
add ecx, 4
test dx, dx
jne 0x43a0b0
xor eax, eax
jmp 0x43a0db
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x43a102
push 0x549dac
push esi
push str._s_s
lea edx, [esp + 0x1c]
call fcn.004023b0
lea edx, [esp + 0x1c]
push 1
push edx
call fcn.00439fd0
add esp, 0x14
push 0x549d80
push edi
call ebx
test eax, eax
jne 0x43a061
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
cmp byte [esp + 0x818], 0
pop edi
je 0x43a137
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x43a135
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, eax
mov ecx, dword [esp + 0x808]
pop esi
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.004cc2b1
add esp, 0x804
ret
Function at 0x43a560
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x50a09c
mov eax, dword fs:[0]
push eax
sub esp, 0x3a8
mov eax, dword [0x53f5a0]
xor eax, esp
mov dword [esp + 0x3a0], eax
push ebx
mov eax, dword [0x53f5a0]
xor eax, esp
push eax
lea eax, [esp + 0x3b0]
mov dword fs:[0], eax
push 0x208
xor ebx, ebx
push ebx
push esi
call fcn.004d3360
add esp, 0xc
lea ecx, [esp + 0x280]
mov dword [esp + method.t_reg.virtual_0], vtable.t_reg.0
call fcn.00438f20
mov eax, str.HKEY_LOCAL_MACHINE
lea edx, [esp + 0x280]
mov dword [esp + 0x278], ebx
mov dword [esp + 0x27c], reloc.WS2_32.dll_bind
call fcn.00439130
mov dword [esp + 0x3b8], ebx
lea ecx, [esp + 0x150]
mov dword [esp + method.t_reg.virtual_0], vtable.t_reg.0
call fcn.00438f20
mov eax, str.HKEY_CURRENT_USER
lea edx, [esp + 0x150]
mov dword [esp + 0x148], ebx
mov dword [esp + 0x14c], reloc.WS2_32.dll_accept
call fcn.00439130
mov byte [esp + 0x10], bl
mov dword [esp + 0xc], ebx
push str.SoftwareSogouExplorer
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x27c]
mov byte [esp + 0x3c0], 2
call fcn.004446c0
test al, al
jne 0x43a67b
push str.SoftwareSogouExplorer
lea ecx, [esp + 0x10]
push ecx
lea eax, [esp + 0x14c]
call fcn.004446c0
test al, al
je 0x43a718
lea ecx, [esp + 0x144]
jmp 0x43a682
lea ecx, [esp + 0x274]
push 1
lea edx, [esp + 0x1c]
push edx
push esi
lea eax, [esp + 0x18]
push eax
xor eax, eax
mov dword [esp + 0x28], 0x208
call fcn.00444810
test al, al
je 0x43a718
push str.SogouExplorer.exe
push 0x104
push esi
call fcn.004cc943
add esp, 0xc
lea ecx, [esp + 0x1c]
call fcn.00438f20
mov eax, esi
lea edx, [esp + 0x1c]
call fcn.00439130
lea eax, [esp + 0x28]
cmp byte [esp + 0x138], bl
jne 0x43a6da
mov eax, dword [esp + 0x24]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43a6f2
shr eax, 4
not al
and al, 1
jne 0x43a73d
mov dword [esp + 0x1c], vtable.t_str.0
cmp byte [esp + 0x138], bl
jne 0x43a718
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x28]
cmp eax, ecx
je 0x43a718
push eax
call fcn.004cc2c0
add esp, 4
lea ecx, [esp + 0xc]
call fcn.004382a0
lea ecx, [esp + 0x144]
call fcn.00444670
lea ecx, [esp + 0x274]
call fcn.00444670
xor eax, eax
jmp 0x43a789
mov dword [esp + 0x1c], vtable.t_str.0
cmp byte [esp + 0x138], bl
jne 0x43a763
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x28]
cmp eax, edx
je 0x43a763
push eax
call fcn.004cc2c0
add esp, 4
lea ecx, [esp + 0xc]
call fcn.004382a0
lea ecx, [esp + 0x144]
call fcn.00444670
lea ecx, [esp + 0x274]
call fcn.00444670
mov eax, 1
mov ecx, dword [esp + 0x3b0]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x3a0]
xor ecx, esp
call fcn.004cc2b1
mov esp, ebp
pop ebp
ret