joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e830
Capabilities:
Check if file exists
Copy file
Create directory
Delete file
Get common file path

Disassembly:
sub esp, 0xf20
mov eax, dword [0x494db8]
xor eax, esp
mov dword [esp + 0xf1c], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0xf34]
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x326]
push ecx
mov word [esp + 0x328], ax
call fcn.0045bc00
mov edx, dword [edi]
push edx
lea eax, [esp + 0x32c]
push 0x104
push eax
call fcn.0045d487
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
add esp, 0x18
push 0x47b430
lea ecx, [esp + 0x320]
push ecx
call ebx
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea edx, [esp + 0x31c]
push edx
call ebp
test eax, eax
jne 0x43e8b6
xor eax, eax
jmp 0x43ea50
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1e]
push ecx
mov word [esp + 0x20], ax
call fcn.0045bc00
add esp, 0xc
lea edx, [esp + 0x14]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
push 0xfe
push eax
lea ecx, [esp + 0x226]
push ecx
mov word [esp + 0x228], ax
call fcn.0045bc00
add esp, 0xc
cmp dword [esi + 0x14], 0
jne 0x43e90e
call fcn.00401340
mov dword [esi + 0x14], eax
mov esi, dword [esi + 0x14]
mov edx, dword [esi]
mov ecx, dword [edx + 0x2c]
push 0x80
lea eax, [esp + 0x220]
push eax
push esi
call ecx
lea edx, [esp + 0x21c]
push edx
lea eax, [esp + 0x18]
push eax
call ebx
lea ecx, [esp + 0x14]
push ecx
call ebp
test eax, eax
je 0x43e94d
lea edx, [esp + 0x14]
push edx
call fcn.00421aa0
add esp, 4
push 0
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.Au_.exe
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x52c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0
lea eax, [esp + 0x528]
push eax
lea ecx, [esp + 0x324]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x43e8af
lea edx, [esp + 0x524]
push edx
lea eax, [esp + 0x730]
push 0x400
push eax
mov dword [esp + 0x1c], 0
call fcn.0045d487
push str.__S__SDSilent___
lea ecx, [esp + 0x73c]
push 0x400
push ecx
call fcn.0045c24a
mov edx, dword [edi]
push edx
lea eax, [esp + 0x748]
push 0x400
push eax
call fcn.0045c24a
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x754]
push edx
call fcn.0043e640
add esp, 0x2c
test eax, eax
je 0x43e8af
mov esi, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push esi
call edi
cmp eax, 0x102
jne 0x43ea30
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea esp, [esp]
push 1
call ebx
push 0
push esi
call edi
cmp eax, 0x102
je 0x43ea20
lea eax, [esp + 0x524]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x14]
push ecx
call fcn.00421aa0
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0xf2c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0045bbec
add esp, 0xf20
ret 4
Function at 0x43ec60
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43ec76
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x43ec7c
mov eax, 1
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
jne 0x43eca1
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x43eca8
push esi
call edi
test eax, eax
je 0x43eca8
mov eax, 1
pop edi
ret
xor eax, eax
pop edi
ret

Function at 0x43ed00
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x804
mov eax, dword [0x494db8]
xor eax, esp
mov dword [esp + 0x800], eax
mov eax, dword [esp + 0x808]
push esi
mov esi, dword [eax]
mov eax, dword [esi - 8]
test eax, eax
jne 0x43ed3f
xor eax, eax
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.0045bbec
add esp, 0x804
ret 4
cmp eax, 0x104
jge 0x43ed25
push 0x800
lea eax, [esp + 8]
push 0
push eax
call fcn.0045bc00
add esp, 0xc
push 0x47ebe8
push esi
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edx, [esp + 4]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [esp + 0x804]
pop esi
xor ecx, esp
call fcn.0045bbec
add esp, 0x804
ret 4
Function at 0x43ef70
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x1104
call fcn.0045cb30
mov eax, dword [0x494db8]
xor eax, esp
mov dword [esp + 0x1100], eax
mov eax, dword [esp + 0x1108]
push ebp
mov ebp, dword [esp + 0x1114]
push esi
mov esi, dword [eax]
cmp dword [esi - 8], 0x104
push edi
mov edi, dword [esp + 0x1118]
jle 0x43efc5
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x1100]
xor ecx, esp
call fcn.0045bbec
add esp, 0x1104
ret
push 0x800
lea eax, [esp + 0x910]
push 0
push eax
call fcn.0045bc00
push 0x800
lea ecx, [esp + 0x11c]
push 0
push ecx
call fcn.0045bc00
push esi
lea edx, [esp + 0x928]
push 0x400
push edx
call fcn.0045d487
add esp, 0x24
test edi, edi
je 0x43f01c
cmp word [edi], 0
je 0x43f01c
push edi
lea eax, [esp + 0x910]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push ebx
push 0x100
lea ecx, [esp + 0x14]
push 0
push ecx
call fcn.0045bc00
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
xor esi, esi
nop
lea edx, [esp + 0x10]
push 0x80
push edx
call fcn.00401000
add esp, 8
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x914]
push ecx
lea edx, [esp + 0x118]
push edx
call edi
lea eax, [esp + 0x110]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x43f073
mov ecx, dword [str..tmp]
mov edx, dword [0x483f3c]
mov dword [eax], ecx
mov cx, word [0x483f40]
mov dword [eax + 4], edx
lea edx, [esp + 0x110]
push edx
mov word [eax + 8], cx
call ebx
test eax, eax
je 0x43f0ca
inc esi
cmp esi, 0xa
jl 0x43f040
xor eax, eax
mov ecx, dword [esp + 0x1110]
pop ebx
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0045bbec
add esp, 0x1104
ret
lea eax, [esp + 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
push edi
mov ecx, ebp
call fcn.0041a990
test eax, eax
je 0x43f114
lea esi, [edi + edi]
lea ecx, [esi + 2]
cmp ecx, esi
jb 0x43f105
mov eax, dword [ebp]
push esi
lea edx, [esp + 0x114]
push edx
push eax
call fcn.0045c2d0
add esp, 0xc
mov ecx, dword [ebp]
mov dword [ecx - 8], edi
mov edx, dword [ebp]
xor eax, eax
mov word [esi + edx], ax
mov eax, 1
jmp 0x43f0b1
Function at 0x43fcc0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x475a16
mov eax, dword fs:[0]
push eax
sub esp, 0x810
mov eax, dword [0x494db8]
xor eax, esp
mov dword [esp + 0x80c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x494db8]
xor eax, esp
push eax
lea eax, [esp + 0x824]
mov dword fs:[0], eax
xor eax, eax
push 0x7fe
mov esi, ecx
push eax
lea ecx, [esp + 0x2a]
push ecx
mov word [esp + 0x2c], ax
call fcn.0045bc00
add esp, 0xc
lea edx, [esp + 0x20]
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0041e0e0
call fcn.0042ac70
add esp, 4
test eax, eax
jne 0x43fe1d
push eax
push eax
push 0x32e
mov ecx, esi
call fcn.0043f8b0
push 0x96
lea ecx, [esp + 0x18]
call fcn.0041c830
mov edi, eax
push 0xd4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x830], 0
call fcn.0041c830
mov edi, dword [edi]
mov ebx, dword [eax]
lea ecx, [esi + 0x18]
mov byte [esp + 0x82c], 1
call fcn.00425de0
test eax, eax
je 0x43fdc1
mov ebp, dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetActiveWindow]
test ebp, ebp
jne 0x43fdb1
push 0x40
push edi
push ebx
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x43fdc1
push 0
push 0
push 0x40
push edi
push ebx
push eax
mov ecx, esi
call fcn.0043f320
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x493010]
je 0x43fdf0
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x43fdf0
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.0045c814
add esp, 4
mov eax, dword [esp + 0x14]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x493010]
je 0x43fe19
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x43fe19
mov edx, dword [esp + 0x14]
add edx, 0xfffffff4
push edx
call fcn.0045c814
add esp, 4
xor eax, eax
jmp 0x43fe22
mov eax, 1
mov ecx, dword [esp + 0x824]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x80c]
xor ecx, esp
call fcn.0045bbec
add esp, 0x81c
ret
Function at 0x440f80
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
test ecx, ecx
je 0x440f8b
lea edi, [ecx - 0x30]
jmp 0x440f8d
xor edi, edi
cmp byte [ecx + 0x1c], 0
mov esi, dword [esp + 0x10]
je 0x440fc5
mov eax, dword [edi + 4]
push 0xe801
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp esi, 2
jne 0x440fb6
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x440fca
test esi, esi
jne 0x440fc5
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x440fca
cmp esi, 1
je 0x440fe1
mov eax, dword [esp + 0x14]
mov ecx, eax
shr ecx, 0x10
movsx edx, cx
cwde
push edx
push eax
lea ecx, [edi + 0x30]
call fcn.00440970
pop edi
xor eax, eax
pop esi
ret 0x10

Function at 0x441020
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x474b98
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x494db8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.CStartupDialog.1.0
mov dword [esi + 0x14], vtable.CStartupDialog.0
xor edi, edi
lea ecx, [esi + 0x5c]
mov dword [esp + 0x18], edi
call fcn.004480f0
mov eax, dword [esi + 0x30]
mov dword [esp + 0x18], 0xffffffff
cmp eax, edi
je 0x44107f
push eax
call fcn.0045d4f6
add esp, 4
mov dword [esi + 0x30], edi
mov ecx, esi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
call fcn.00428f70
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x441130
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x474bf8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x494db8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.0043b4f0
xor eax, eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
or ecx, 0xffffffff
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov byte [esi + 0x4c], al
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], ecx
mov dword [esi + 0xc], eax
mov dword [esi], vtable.CStartupDialog.1.0
mov dword [esi + 0x14], vtable.CStartupDialog.0
lea ecx, [esi + 0x5c]
mov dword [esp + 0x14], eax
mov dword [esi + 0x58], eax
call fcn.004481a0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x441360
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x475adb
mov eax, dword fs:[0]
push eax
sub esp, 0x418
mov eax, dword [0x494db8]
xor eax, esp
mov dword [esp + 0x414], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x494db8]
xor eax, esp
push eax
lea eax, [esp + 0x42c]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 4]
push 0
lea ebp, [edi + 0x5c]
push eax
mov ecx, ebp
call fcn.004410a0
mov ecx, dword [edi + 0x60]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4414c6
mov edx, dword [edi + 0x60]
push 1
push 0x13
push 0x32
push 0x32
push 0x168
push edx
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [edi + 8]
mov eax, dword [ecx]
mov edx, dword [eax]
call edx
test eax, eax
je 0x4414c6
mov ecx, eax
call fcn.0043e5d0
mov esi, eax
test esi, esi
je 0x4414c6
mov eax, dword [esi]
mov ecx, dword [eax + 0x14]
push esi
call ecx
mov ebx, eax
test ebx, ebx
je 0x4414c6
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x22]
push eax
mov word [esp + 0x24], dx
call fcn.0045bc00
add esp, 0xc
push 0x103
lea ecx, [esp + 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x22a]
push eax
mov word [esp + 0x22c], dx
call fcn.0045bc00
mov ecx, dword [ebx]
mov ecx, dword [ecx + 0x60]
add esp, 0xc
push 0x103
lea edx, [esp + 0x224]
push edx
lea eax, [esp + 0x20]
push eax
push ebx
call ecx
mov edx, dword [esi]
mov eax, dword [edx + 0x18]
push esi
xor ebx, ebx
call eax
test eax, eax
je 0x441488
mov ecx, dword [eax]
mov edx, dword [ecx + 0x78]
push eax
call edx
mov ebx, eax
lea eax, [esp + 0x220]
push eax
lea ecx, [esp + 0x18]
call fcn.0041e0e0
push ebx
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebp
mov dword [esp + 0x43c], 0
call fcn.00448320
lea ecx, [esp + 0x14]
call fcn.0041a500
mov edx, dword [edi + 0x60]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0x42c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.0045bbec
add esp, 0x424
ret

Function at 0x442020
Capabilities:
Check if file exists
Delete file
Move file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
je 0x44203b
pop edi
mov eax, 1
pop esi
ret
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x442033
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x44205d
push esi
call edi
test eax, eax
jne 0x442033
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop edi
xor eax, eax
pop esi
ret

Function at 0x442080
Capabilities:
Delete registry key

Disassembly:
mov eax, dword [esp + 4]
push eax
call fcn.00442020
add esp, 4
cmp dword [esp + 0x10], 0
je 0x4420a4
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov eax, 1
ret
Function at 0x442390
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x475bd6
mov eax, dword fs:[0]
push eax
sub esp, 0x884
mov eax, dword [0x494db8]
xor eax, esp
mov dword [esp + 0x880], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x494db8]
xor eax, esp
push eax
lea eax, [esp + 0x898]
mov dword fs:[0], eax
mov esi, dword [esp + 0x8a8]
xor ebx, ebx
mov dword [esp + 0x18], esi
cmp esi, ebx
jne 0x4423e3
xor eax, eax
jmp 0x4425b1
cmp word [esi], bx
je 0x4423dc
mov eax, esi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4423f0
sub eax, edx
sar eax, 1
cmp eax, 0x104
jge 0x4423dc
push 0x410
lea eax, [esp + 0x488]
push ebx
push eax
call fcn.0045bc00
add esp, 0xc
push 0x47d76c
push esi
lea ecx, [esp + 0x48c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44244b
test al, 1
je 0x44244b
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, 0x5c
mov word [esp + 0x478], dx
mov dword [esp + 0x47c], ebx
mov dword [esp + 0x480], ebx
lea eax, [esp + 0x484]
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x8a4], ebx
call fcn.0042c8e0
cmp eax, ebx
je 0x442591
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea esp, [esp]
cmp dword [esp + 0x480], ebx
je 0x4424e9
mov ecx, dword [esp + 0x20]
shr ecx, 4
and ecx, 1
je 0x4424e9
cmp word [esp + 0x4c], 0x2e
jne 0x4424e9
mov ax, word [esp + 0x4e]
cmp ax, bx
je 0x4424c4
cmp ax, 0x2e
jne 0x4424e9
cmp word [esp + 0x50], bx
jne 0x4424e9
mov eax, dword [esp + 0x47c]
cmp eax, ebx
je 0x442591
lea edx, [esp + 0x20]
push edx
push eax
call ebp
mov dword [esp + 0x480], eax
mov esi, eax
jmp 0x442585
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
call fcn.0042d4f0
mov byte [esp + 0x8a0], 1
cmp dword [esp + 0x480], ebx
je 0x442522
mov eax, dword [esp + 0x20]
shr eax, 4
and eax, 1
cmp eax, ebx
je 0x442522
mov edi, dword [esp + 0x14]
push edi
call fcn.00442390
jmp 0x44252c
mov edi, dword [esp + 0x14]
push edi
call fcn.00442020
mov eax, dword [esp + 0x480]
add esp, 4
cmp eax, ebx
jne 0x44253e
xor esi, esi
jmp 0x44255c
cmp dword [esp + 0x480], ebx
jne 0x44254b
xor esi, esi
jmp 0x44255c
lea ecx, [esp + 0x20]
push ecx
push eax
call ebp
mov dword [esp + 0x480], eax
mov esi, eax
lea edx, [edi - 0xc]
mov byte [esp + 0x8a0], bl
cmp edx, dword [0x493010]
je 0x442585
add edi, 0xfffffff4
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x442585
push edi
call fcn.0045c814
add esp, 4
cmp esi, ebx
mov esi, dword [esp + 0x18]
jne 0x442490
lea ecx, [esp + 0x20]
call fcn.0042c870
push esi
call fcn.00421aa0
add esp, 4
lea ecx, [esp + 0x20]
call fcn.0042c870
mov eax, 1
mov ecx, dword [esp + 0x898]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x880]
xor ecx, esp
call fcn.0045bbec
add esp, 0x890
ret
Function at 0x4431f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x475c26
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x494db8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea eax, [esp + 0xb]
push eax
lea edx, [esp + 0xf]
lea ecx, [esi + 4]
push edx
mov dword [esi], vtable.CUninstaller.0
call fcn.00442650
xor eax, eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov ecx, dword [0x493014]
mov dword [esp + 0x18], eax
mov dword [esi + 0x40], ecx
lea ecx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [esi + 0x44], eax
call fcn.0042fb90
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
Function at 0x4432e0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x475c5b
mov eax, dword fs:[0]
push eax
sub esp, 0x2a8
mov eax, dword [0x494db8]
xor eax, esp
mov dword [esp + 0x2a4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x494db8]
xor eax, esp
push eax
lea eax, [esp + 0x2bc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x2cc]
mov esi, ecx
mov ebx, dword [esi + 0x2c]
test ebx, ebx
je 0x443389
cmp dword [esi + 0x30], 0
je 0x443389
push 0x2a0
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.0045bc00
mov ecx, dword [esi + 0x40]
mov eax, dword [ecx - 8]
lea eax, [edi + eax*2]
add esp, 0xc
cmp word [eax], 0x5c
jne 0x443357
add eax, 2
mov edx, dword [ebx]
mov edx, dword [edx + 0x10]
lea ecx, [esp + 0x18]
push ecx
push eax
push ebx
call edx
test eax, eax
je 0x443389
cmp dword [esp + 0x2ac], 0
jne 0x44337d
cmp dword [esp + 0x2a8], 0
je 0x443389
mov eax, dword [esi + 0x30]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
push edi
push eax
call edx
mov eax, dword [esi + 0x24]
test eax, eax
je 0x4433ab
movzx ecx, word [esi + 0x38]
movzx edx, word [esi + 0x3c]
shl ecx, 0x10
or ecx, edx
push ecx
push edi
push 0x343f
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
inc dword [esi + 0x38]
push edi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 0xffffffff
je 0x4433df
test al, 0x10
je 0x4433df
push edi
mov ebx, 1
call fcn.00421aa0
add esp, 4
test eax, eax
je 0x4433e6
mov eax, ebx
jmp 0x443485
push edi
call ebp
test eax, eax
jne 0x443401
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x44341b
push edi
test ebx, ebx
jne 0x443408
call ebp
test eax, eax
je 0x44341b
mov eax, 1
jmp 0x443485
call fcn.00421aa0
add esp, 4
test eax, eax
je 0x44341b
mov eax, 1
jmp 0x443485
push edi
lea ecx, [esp + 0x18]
call fcn.0041e0e0
lea eax, [esp + 0x14]
push eax
lea ecx, [esi + 0x48]
mov dword [esp + 0x2c8], 0
call fcn.004212e0
mov eax, dword [esp + 0x14]
lea ecx, [eax - 0xc]
mov dword [esp + 0x2c4], 0xffffffff
cmp ecx, dword [0x493010]
je 0x44346e
lea edi, [eax - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x44346e
push edi
call fcn.0045c814
add esp, 4
mov ecx, dword [esi + 0x28]
mov dword [esi + 0x44], 1
test ecx, ecx
je 0x443483
push 1
call fcn.0043ecb0
xor eax, eax
mov ecx, dword [esp + 0x2bc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2a4]
xor ecx, esp
call fcn.0045bbec
add esp, 0x2b4
ret 4
Function at 0x4446a0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x804
mov eax, dword [0x494db8]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 4]
call edx
test eax, eax
jne 0x4446d8
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.0045bbec
add esp, 0x804
ret
push edi
push 0x800
xor edi, edi
lea eax, [esp + 0xc]
push edi
push eax
call fcn.0045bc00
mov ecx, dword [esi + 4]
add esp, 0xc
push str.360ver.dll
push ecx
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
cmp dword [0x4982d4], edi
jne 0x444716
lea eax, [esp + 8]
push eax
call fcn.00402e20
jmp 0x444746
call fcn.00401ee0
test eax, eax
jne 0x44473b
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44473b
lea edx, [esp + 8]
push edx
call fcn.00401f60
add esp, 4
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x44476e
push str.IsBetaVersion
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x444767
call eax
test eax, eax
je 0x444767
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x808]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.0045bbec
add esp, 0x804
ret

Function at 0x444b70
Capabilities:
Check if file exists

Disassembly:
call fcn.00401ee0
test eax, eax
je 0x444b7f
mov eax, 1
ret
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x444bc2
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x444bc2
push esi
call fcn.0045baa0
add esp, 4
test eax, eax
je 0x444bc2
push esi
call fcn.00401f60
add esp, 4
test eax, eax
jne 0x444bc2
push 1
call fcn.0045b750
push eax
push esi
call fcn.0045b960
add esp, 0xc
xor eax, eax
pop esi
ret
mov eax, 1
pop esi
ret
Function at 0x444cc0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x472e0b
mov eax, dword fs:[0]
push eax
sub esp, 0x808
mov eax, dword [0x494db8]
xor eax, esp
mov dword [esp + 0x804], eax
push esi
push edi
mov eax, dword [0x494db8]
xor eax, esp
push eax
lea eax, [esp + 0x814]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0043b3c0
mov edi, eax
test edi, edi
je 0x444dcd
mov eax, dword [0x493014]
mov dword [esp + 0xc], eax
mov ecx, esi
mov dword [esp + 0x81c], 0
call fcn.0043b370
test eax, eax
je 0x444da0
lea ecx, [esp + 0xc]
push ecx
mov ecx, eax
call fcn.0043f650
push 0x800
lea edx, [esp + 0x14]
push 0
push edx
call fcn.0045bc00
mov eax, dword [esp + 0x18]
add esp, 0xc
push str.firstaidSuperKiller.exe
push eax
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x444d86
mov eax, dword [edi]
mov edx, dword [eax + 0x24]
push 0
push 0
push 1
push 5
push 0
lea ecx, [esp + 0x24]
push ecx
push edi
call edx
jmp 0x444da0
push 1
push 0
push 0
push str.http:__down.360safe.com_SuperKiller.zip
push str.open
push 0
call fcn.0045bbb0
add esp, 0x18
mov eax, dword [esp + 0xc]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x493010]
je 0x444dcd
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x444dcd
mov edx, dword [esp + 0xc]
add edx, 0xfffffff4
push edx
call fcn.0045c814
add esp, 4
mov ecx, dword [esp + 0x814]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.0045bbec
add esp, 0x814
ret