joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43eeea
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48c200
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1020
call fcn.00457a70
push ebx
push esi
push edi
mov eax, dword [0x4b4970]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp + 8]
cmp eax, dword [ecx + 0x14]
je 0x43ef30
xor eax, eax
inc eax
jmp 0x43f0fb
mov esi, dword [ebp + 0x10]
cmp dword [esi + 0x10], 1
jne 0x43f0f9
mov eax, dword [esi]
xor edi, edi
mov dword [ebp + 8], edi
mov dword [ebp - 4], edi
cmp eax, edi
je 0x43ef92
push eax
lea eax, [ebp - 0x828]
push 0x498d3c
push eax
call fcn.0041e3bc
add esp, 0xc
push dword [eax]
mov byte [ebp - 4], 1
call fcn.0044841f
lea eax, [ebp - 0x820]
pop ecx
cmp dword [ebp - 0x828], eax
je 0x43ef86
push dword [ebp - 0x828]
call fcn.0045471c
pop ecx
mov dword [ebp + 8], 0x80004005
jmp 0x43f090
mov eax, dword [ecx + 0x1c]
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x43f00d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
lea eax, [ebp - 0x828]
push 0x498db4
push eax
call fcn.0041e3bc
add esp, 0xc
push dword [eax]
mov byte [ebp - 4], 2
call fcn.0044841f
lea eax, [ebp - 0x820]
pop ecx
cmp dword [ebp - 0x828], eax
je 0x43eff5
push dword [ebp - 0x828]
call fcn.0045471c
pop ecx
cmp esi, edi
jle 0x43f005
and esi, 0xffff
or esi, 0x80070000
mov dword [ebp + 8], esi
jmp 0x43f090
lea eax, [ebp - 0x14]
call fcn.00436ac5
push edi
lea eax, [ebp + 0x10]
push eax
push dword [esi + 0xc]
mov byte [ebp - 4], 3
push dword [esi + 8]
mov dword [ebp + 0x10], edi
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, edi
jne 0x43f088
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
lea eax, [ebp - 0x828]
push 0x498da0
push eax
call fcn.0041e3bc
add esp, 0xc
push dword [eax]
mov byte [ebp - 4], 4
call fcn.0044841f
lea eax, [ebp - 0x820]
pop ecx
cmp dword [ebp - 0x828], eax
je 0x43f075
push dword [ebp - 0x828]
call fcn.0045471c
pop ecx
cmp esi, edi
jle 0x43f085
and esi, 0xffff
or esi, 0x80070000
mov dword [ebp + 8], esi
lea eax, [ebp - 0x14]
call fcn.0043a338
or dword [ebp - 4], 0xffffffff
cmp dword [ebp + 8], edi
jge 0x43f0eb
push str.CFileDownloader::UploadCallback
push 0x106
push str.._filedownloader.cpp
push dword [ebp + 8]
lea eax, [ebp - 0x1030]
push str.EXECEPTION:__X__File:__s__Line:__d__Func:__s
push eax
call fcn.0041e3bc
push dword [eax]
mov dword [ebp - 4], 6
call fcn.0044841f
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x1028]
add esp, 0x1c
cmp dword [ebp - 0x1030], eax
je 0x43f0eb
push dword [ebp - 0x1030]
call fcn.0045471c
pop ecx
mov ecx, dword [ebp - 0x18]
push dword [ebp + 8]
add ecx, 4
mov eax, dword [ecx]
call dword [eax + 8]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x43f152
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ecx + 0x2c], 0
jne 0x43f161
pop ebp
jmp fcn.0043ec4c
pop ebp
jmp fcn.0043eeea
Function at 0x43f87f
Capabilities:
Get file size

Disassembly:
push edi
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocString
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x43f8c3
push esi
mov esi, dword [esp + 0x10]
test esi, esi
je 0x43f8be
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, 1
pop edi
ret
xor al, al
pop edi
ret

Function at 0x43fa11
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x105c]
mov eax, 0x105c
call fcn.00457a70
push 0xffffffffffffffff
push 0x48c362
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x4b4970]
xor eax, ebp
mov dword [ebp + 0x1058], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x1068]
mov esi, dword [ebp + 0x1064]
push 0x10
xor edi, edi
push edi
push eax
mov dword [ebp - 0x1c], eax
call fcn.00454800
mov esi, dword [esi]
add esp, 0xc
push edi
push edi
push 3
push edi
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, eax
mov dword [ebp - 0x14], ecx
cmp ecx, 0xffffffff
jne 0x43fac1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x43fa9e
and eax, 0xffff
or eax, 0x80070000
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1058]
xor ecx, ebp
call fcn.0045466b
add ebp, 0x105c
leave
ret
lea eax, [ebp - 0x18]
call fcn.00436ac5
push edi
push ecx
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43fafd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x43faef
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
lea eax, [ebp - 0x18]
call fcn.0043a338
mov eax, edi
jmp 0x43fa9e
lea eax, [ebp]
push eax
call fcn.0041a60f
pop ecx
mov dword [ebp - 0x10], edi
mov ebx, esi
cmp esi, edi
jbe 0x43fb52
mov esi, 0x1000
cmp ebx, esi
jae 0x43fb1b
mov esi, ebx
push edi
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp + 0x58]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43fadb
cmp esi, dword [ebp - 0x10]
jne 0x43fadb
push dword [ebp - 0x10]
lea eax, [ebp + 0x58]
push eax
lea eax, [ebp]
push eax
call fcn.0041a637
add esp, 0xc
sub ebx, dword [ebp - 0x10]
jne 0x43fb10
push dword [ebp - 0x1c]
lea eax, [ebp]
push eax
call fcn.0041a6cd
pop ecx
pop ecx
jmp 0x43faf1
Function at 0x43fb62
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
push edi
call fcn.00453559
mov esi, eax
pop ecx
mov ecx, esi
lea eax, [ebp - 4]
call fcn.00436ac5
push esi
push edi
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x43fbd7
and dword [ebp - 8], 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x4a1f38
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x43fbd7
mov eax, dword [ebp - 8]
test eax, eax
je 0x43fbd7
mov esi, dword [eax + 8]
mov eax, dword [eax + 0xc]
xor edi, edi
xor ecx, ecx
or edi, eax
lea eax, [ebp - 4]
or esi, ecx
call fcn.0043f90a
mov eax, edi
mov edx, esi
jmp 0x43fbe3
lea eax, [ebp - 4]
call fcn.0043f90a
xor eax, eax
xor edx, edx
pop edi
pop esi
leave
ret

Function at 0x43ff5e
Capabilities:
Move file

Disassembly:
push 0x808
mov eax, 0x4897e2
call fcn.00454dca
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov esi, eax
xor eax, eax
test esi, esi
jne 0x43ff93
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x43ff93
mov dword [ecx], eax
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 0x10]
neg ecx
push dword [ebp + 8]
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
lea eax, [ebp - 0x814]
push str._move__u____s_____u______s_
push eax
call fcn.0041e3bc
push dword [eax]
and dword [ebp - 4], 0
call fcn.0044841f
lea eax, [ebp - 0x80c]
add esp, 0x1c
cmp dword [ebp - 0x814], eax
je 0x43ffe0
push dword [ebp - 0x814]
call fcn.0045471c
pop ecx
mov eax, esi
call fcn.00454ea2
ret

Function at 0x43ffe8
Capabilities:
Copy file

Disassembly:
push 0x808
mov eax, 0x4897e2
call fcn.00454dca
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
test esi, esi
je 0x440010
xor eax, eax
jmp 0x440016
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x814]
push str._copy__u____s_____d______s_
push eax
call fcn.0041e3bc
push dword [eax]
and dword [ebp - 4], 0
call fcn.0044841f
lea eax, [ebp - 0x80c]
add esp, 0x1c
cmp dword [ebp - 0x814], eax
je 0x440059
push dword [ebp - 0x814]
call fcn.0045471c
pop ecx
mov eax, esi
call fcn.00454ea2
ret
Function at 0x440061
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48c3b3
mov eax, dword fs:[0]
push eax
mov eax, 0x1818
call fcn.00457a70
push ebx
push esi
push edi
mov eax, dword [0x4b4970]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
test edi, edi
jne 0x4400a9
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push edi
lea eax, [ebp - 0x101c]
push str._d___s_
push eax
call fcn.0041e3bc
push dword [eax]
and dword [ebp - 4], 0
call fcn.0044841f
lea eax, [ebp - 0x1014]
add esp, 0x10
cmp dword [ebp - 0x101c], eax
je 0x4400e3
push dword [ebp - 0x101c]
call fcn.0045471c
pop ecx
push 4
pop esi
push esi
mov dword [ebp + 8], esi
call fcn.0041e0d6
xor ebx, ebx
inc ebx
push edi
mov dword [ebp - 4], ebx
call fcn.0043f86c
pop ecx
pop ecx
test al, al
jne 0x44011d
push 0x498fa8
call fcn.0044841f
xor bl, bl
pop ecx
push 0xfffffffffffffffc
call fcn.0041e0d6
pop ecx
mov al, bl
jmp 0x440099
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x44010e
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x440141
push 0x498f88
call fcn.0044841f
jmp 0x44010d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x1824]
call fcn.0041f6c0
sub esp, 0x808
mov esi, eax
mov edi, esp
lea eax, [ebp - 0x814]
push 0x498f6c
mov ecx, 0x202
push eax
mov byte [ebp - 4], 2
rep movsd dword es:[edi], dword [esi]
call fcn.0041e3bc
push dword [eax]
mov byte [ebp - 4], 3
call fcn.00448434
lea eax, [ebp - 0x80c]
add esp, 0x814
cmp dword [ebp - 0x814], eax
je 0x4401a4
push dword [ebp - 0x814]
call fcn.0045471c
pop ecx
lea eax, [ebp - 0x181c]
cmp dword [ebp - 0x1824], eax
je 0x4401be
push dword [ebp - 0x1824]
call fcn.0045471c
pop ecx
xor bl, bl
jmp 0x44010e
Function at 0x440474
Capabilities:
Write file on windows

Disassembly:
push 0x80c
mov eax, 0x48c450
call fcn.00454dca
push dword [ebp + 8]
lea eax, [ebp - 0x818]
push 0x4991cc
push eax
call fcn.0041e3bc
push dword [eax]
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0044841f
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x810]
add esp, 0x10
cmp dword [ebp - 0x818], eax
je 0x4404c4
push dword [ebp - 0x818]
call fcn.0045471c
pop ecx
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x44053c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
lea eax, [ebp - 0x818]
push 0x4991b4
push eax
call fcn.0041e3bc
push dword [eax]
mov dword [ebp - 4], 1
call fcn.0044841f
lea eax, [ebp - 0x810]
add esp, 0x10
cmp dword [ebp - 0x818], eax
je 0x440528
push dword [ebp - 0x818]
call fcn.0045471c
pop ecx
cmp esi, edi
jle 0x440538
and esi, 0xffff
or esi, 0x80070000
mov eax, esi
jmp 0x440564
cmp dword [ebp + 0xc], edi
je 0x44055b
cmp dword [ebp + 0x10], edi
jbe 0x44055b
push edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0x10], edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
call fcn.00454ea2
ret
Function at 0x440bbf
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
sub esp, 0x990
lea ebp, [esp - 4]
mov eax, dword [0x4b4970]
xor eax, ebp
mov dword [ebp + 0x990], eax
push 0x2c
mov eax, 0x48c4b9
call fcn.00454dca
mov ebx, dword [ebp + 0x99c]
xor edi, edi
push 0x4b6d04
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], edi
call fcn.0041acdf
lea eax, [ebp]
push eax
push 0x202
mov dword [ebp - 4], edi
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x440c21
lea eax, [ebp - 0x10]
push eax
mov ecx, ebx
call fcn.0041c0ee
jmp 0x440cd7
mov esi, 0x400
push esi
lea eax, [ebp + 0x190]
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
je 0x440c4c
lea eax, [ebp - 0x10]
push eax
mov ecx, ebx
call fcn.0041c0ee
jmp 0x440cd2
push 0x20
lea eax, [ebp - 0x38]
push edi
push eax
call fcn.00454800
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x38]
push eax
push edi
lea eax, [ebp + 0x190]
push eax
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x30], 1
call dword [sym.imp.WS2_32.dll_getaddrinfo]
cmp eax, edi
jne 0x440c3c
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.00436ac5
push 2
push edi
push edi
push esi
lea eax, [ebp + 0x590]
push eax
mov eax, dword [ebp - 0x18]
push dword [eax + 0x10]
mov byte [ebp - 4], 2
push dword [eax + 0x18]
call dword [sym.imp.WS2_32.dll_getnameinfo]
mov ecx, ebx
test eax, eax
je 0x440cbe
lea eax, [ebp - 0x10]
push eax
call fcn.0041c0ee
jmp 0x440cca
lea eax, [ebp + 0x590]
push eax
call fcn.0042c21b
lea eax, [ebp - 0x14]
call fcn.0043f919
call sub.WS2_32.dll_WSACleanup
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0041a963
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x990]
xor ecx, ebp
call fcn.0045466b
add ebp, 0x994
leave
ret
Function at 0x440e87
Capabilities:
Query service status
Start service

Disassembly:
push 0x878
mov eax, 0x48c52f
call fcn.00454e33
mov esi, dword [ebp + 8]
push 0x4993a0
call fcn.0044841f
push 4
pop eax
push eax
mov dword [ebp - 0x54], eax
call fcn.0041e0d6
xor edi, edi
push 0x499394
mov dword [ebp - 4], edi
call fcn.0044841f
add esp, 0xc
push 1
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
cmp ebx, edi
sete al
movzx eax, al
push eax
call fcn.0043ff0e
pop ecx
mov ecx, ebx
lea eax, [ebp - 0x40]
call fcn.00436ac5
push 0x14
push str.BaiduUpdater
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
cmp ebx, edi
sete al
movzx eax, al
push eax
call fcn.0043ff0e
pop ecx
mov ecx, ebx
lea eax, [ebp - 0x3c]
call fcn.00436ac5
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 2
call fcn.00440d07
push edi
push edi
push dword [ebp - 0x34]
mov byte [ebp - 4], 3
call fcn.00440474
push 0x499388
call fcn.0044841f
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0xa
push 0x10
lea ecx, [ebp - 0x30]
push ecx
push eax
call fcn.004583c1
lea eax, [ebp - 0x30]
mov dword [ebp - 0x4c], eax
mov eax, dword [0x4b6bd4]
add esp, 0x10
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x50]
push eax
push 4
push ebx
mov dword [ebp - 0x50], str.elevate
mov dword [ebp - 0x44], esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
cmp eax, 0x420
jne 0x440fac
push 0x49935c
call fcn.0044841f
lea eax, [ebp - 0x4c]
push eax
push 3
call fcn.0043d22c
add esp, 0xc
test eax, eax
je 0x44104c
push 0x49934c
call fcn.0044841f
xor eax, eax
pop ecx
inc eax
cmp eax, edi
sete al
movzx eax, al
push eax
call fcn.0043ff0e
mov dword [esp], 0x499338
call fcn.0044841f
pop ecx
mov dword [ebp - 0x38], edi
lea eax, [ebp - 0x58]
push eax
push 0x24
lea eax, [ebp - 0x7c]
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
push dword [ebp - 0x78]
mov esi, eax
push esi
lea eax, [ebp - 0x884]
push 0x499328
push eax
call fcn.0041e3bc
push dword [eax]
mov byte [ebp - 4], 4
call fcn.0044841f
lea eax, [ebp - 0x87c]
add esp, 0x14
mov byte [ebp - 4], 3
cmp dword [ebp - 0x884], eax
je 0x44101f
push dword [ebp - 0x884]
call fcn.0045471c
pop ecx
cmp esi, edi
je 0x441029
cmp dword [ebp - 0x78], 1
je 0x441061
push dword [ebp - 0x34]
call fcn.0043f86c
pop ecx
test al, al
je 0x441080
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x12c
jb 0x440fca
jmp 0x441057
push 0x499314
call fcn.0044841f
pop ecx
push 0x80004005
call fcn.0043fe9b
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 0x34]
call fcn.0043f86c
pop ecx
test al, al
je 0x441080
push 0x4992fc
jmp 0x441051
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0041a963
lea eax, [ebp - 0x3c]
call fcn.0044b4de
lea eax, [ebp - 0x40]
call fcn.0044b4de
push 0xfffffffffffffffc
call fcn.0041e0d6
pop ecx
call fcn.00454eb6
ret
Function at 0x4410a9
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push 0x81c
mov eax, 0x48c580
call fcn.00454dfd
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x4b6d04
lea ecx, [ebp - 0x14]
mov ebx, eax
call fcn.0041acdf
xor esi, esi
xor edi, edi
inc esi
cmp dword [ebp - 0x18], esi
mov dword [ebp - 4], edi
jle 0x441103
push dword [ebx + esi*4]
lea ecx, [ebp - 0x14]
call fcn.00421f76
push 0x495258
lea ecx, [ebp - 0x14]
call fcn.00421f76
inc esi
cmp esi, dword [ebp - 0x18]
jl 0x4410e5
cmp dword [ebp + 8], edi
jne 0x44117f
push 1
push edi
push dword [ebp - 0x14]
push dword [0x4b6bd4]
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x441177
push eax
lea eax, [ebp - 0x828]
push str.shellexecute
push eax
call fcn.0041e3bc
push dword [eax]
mov byte [ebp - 4], 1
call fcn.0044841f
lea eax, [ebp - 0x820]
add esp, 0x10
cmp dword [ebp - 0x828], eax
je 0x44115f
push dword [ebp - 0x828]
call fcn.0045471c
pop ecx
mov edi, 0x80004005
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0041a963
mov eax, edi
call fcn.00454ea2
ret
mov dword [0x4b6c6c], edi
jmp 0x441164
push str.__fromsrv
lea ecx, [ebp - 0x14]
call fcn.00421f76
push dword [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00440e87
pop ecx
jmp 0x441177
Function at 0x4417c1
Capabilities:
Create directory

Disassembly:
push 0xc
mov eax, 0x48c64e
call fcn.00454dca
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.0041ed69
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
xor edi, edi
push edi
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.00421ecf
mov esi, dword [ebp - 0x18]
cmp dword [esi - 0xc], ebx
je 0x441802
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x14], eax
lea ecx, [esi - 0x10]
call fcn.0041a963
inc edi
push edi
push 0x5c
lea ecx, [ebp - 0x10]
call fcn.0043fd0a
mov edi, eax
cmp edi, ebx
jge 0x4417e2
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0041a963
cmp dword [ebp - 0x14], ebx
setne al
call fcn.00454ea2
ret
Function at 0x441be6
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
sub esp, 0x250
lea ebp, [esp - 4]
mov eax, dword [0x4b4970]
xor eax, ebp
mov dword [ebp + 0x250], eax
push 0x1c
mov eax, 0x48c77b
call fcn.00454dca
mov esi, dword [ebp + 0x25c]
mov eax, dword [ebp + 0x260]
mov dword [ebp - 0x18], eax
test esi, esi
je 0x441c25
test eax, eax
je 0x441c25
xor al, al
jmp 0x441c28
xor eax, eax
inc eax
push eax
call fcn.00440e7a
pop ecx
push esi
lea ecx, [ebp - 0x10]
call fcn.0041ed69
and dword [ebp - 4], 0
push 0x4b6d04
lea ecx, [ebp - 0x14]
call fcn.0041acdf
push esi
lea eax, [ebp - 0x14]
push 0x499500
push eax
mov byte [ebp - 4], 1
call fcn.0041b07c
add esp, 0xc
lea eax, [ebp]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
xor eax, eax
cmp ebx, 0xffffffff
setne al
test eax, eax
je 0x441d70
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, 0x4a1f38
lea eax, [ebp + 0x2c]
push 0x4994fc
push eax
call fcn.00456248
pop ecx
pop ecx
test eax, eax
je 0x441cb5
lea eax, [ebp + 0x2c]
push 0x4994f4
push eax
call fcn.00456248
pop ecx
pop ecx
test eax, eax
je 0x441cb5
xor al, al
jmp 0x441cb7
mov al, 1
test byte [ebp], 0x10
je 0x441d61
test al, al
jne 0x441d61
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004223c1
lea ecx, [ebp + 0x2c]
push ecx
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 2
call fcn.004223c1
mov eax, dword [eax]
push dword [ebp - 0x18]
mov byte [ebp - 4], 3
push eax
call fcn.00441abd
mov ecx, dword [ebp - 0x1c]
add esp, 0x20
add ecx, 0xfffffff0
call fcn.0041a963
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.0041a963
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004223c1
lea ecx, [ebp + 0x2c]
push ecx
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 4
call fcn.004223c1
mov eax, dword [eax]
push dword [ebp - 0x18]
mov byte [ebp - 4], 5
push eax
call fcn.00441be6
mov ecx, dword [ebp - 0x24]
add esp, 0x20
add ecx, 0xfffffff0
call fcn.0041a963
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.0041a963
lea eax, [ebp]
push eax
push ebx
call edi
test eax, eax
jne 0x441c89
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0041a963
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0041a963
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x250]
xor ecx, ebp
call fcn.0045466b
add ebp, 0x254
leave
ret
Function at 0x441f90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4b4970]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
push 0x208
lea eax, [ebp - 0x20c]
push edi
push eax
mov dword [ebp - 0x210], edi
call fcn.00454800
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.0041ed69
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0045466b
leave
ret

Function at 0x4425c8
Capabilities:
Accept command line arguments

Disassembly:
push 0x81c
mov eax, 0x48c907
call fcn.00454dca
push 0x4b6d04
lea ecx, [ebp - 0x10]
call fcn.0041acdf
mov eax, dword [ebp + 0x30]
and dword [ebp - 4], 0
mov dword [ebp + 0x30], eax
test eax, eax
jne 0x4425f9
mov dword [ebp + 0x30], 0x4a1d5c
lea eax, [ebp - 0x1c]
push eax
call fcn.00440db8
mov esi, eax
push dword [0x4b6c5c]
lea eax, [ebp - 0x18]
push dword [0x4b6c58]
mov byte [ebp - 4], 1
push eax
call fcn.00440a94
mov edi, eax
push dword [ebp + 0x2c]
lea eax, [ebp - 0x14]
push dword [ebp + 0x28]
mov byte [ebp - 4], 2
push eax
call fcn.00440a94
mov ebx, eax
push dword [ebp + 0x24]
lea eax, [ebp - 0x20]
push dword [ebp + 0x20]
mov byte [ebp - 4], 3
push eax
call fcn.00440a94
add esp, 0x28
mov esi, dword [esi]
mov edi, dword [edi]
mov ebx, dword [ebx]
mov eax, dword [eax]
push esi
push dword [0x4b6c4c]
mov byte [ebp - 4], 4
push dword [0x4b6c48]
push dword [ebp + 0x30]
push dword [0x4b6c74]
push edi
push ebx
push eax
push dword [ebp + 0x1c]
xor eax, eax
cmp byte [ebp + 0x18], al
setne al
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push dword [ebp + 0x14]
xor eax, eax
cmp byte [ebp + 0x10], al
setne al
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push dword [ebp + 8]
push str.Code_s_Component_s_Result_d_Hr0x_x_UpdateStartType_s_Up_d_Level_d_OldVer_s_NewVer_s_UpdaterVer_s_ClientPolicy_d_Trace_s_BaiduID_s_ExternalIP_s_PCCode_s_r_n
push eax
call fcn.0041b07c
mov ecx, dword [ebp - 0x20]
add esp, 0x44
add ecx, 0xfffffff0
call fcn.0041a963
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0041a963
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0041a963
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.0041a963
mov esi, dword [ebp - 0x10]
push esi
lea eax, [ebp - 0x828]
push 0x499610
push eax
call fcn.0041e3bc
push dword [eax]
mov byte [ebp - 4], 5
call fcn.0044841f
lea eax, [ebp - 0x820]
add esp, 0x10
mov byte [ebp - 4], 0
cmp dword [ebp - 0x828], eax
je 0x442716
push dword [ebp - 0x828]
call fcn.0045471c
pop ecx
push esi
call fcn.004424d7
pop ecx
lea ecx, [esi - 0x10]
call fcn.0041a963
call fcn.00454ea2
ret

Function at 0x442937
Capabilities:
Delete file
Move file

Disassembly:
push dword [esp + 4]
call fcn.0043f86c
pop ecx
test al, al
je 0x44294a
jmp fcn.00440061
mov al, 1
ret