joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a630
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4b8cd2
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4eb86c]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov eax, ecx
xor ecx, ecx
mov dword [eax], vtable.CUninstLog.0
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0x50], ecx
mov dword [eax + 0x58], ecx
mov dword [eax + 0x5c], ecx
mov dword [eax + 0x60], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], ecx
mov dword [eax + 0x70], ecx
mov dword [eax + 0x78], ecx
mov dword [eax + 0x7c], ecx
mov dword [eax + 0x80], ecx
mov dword [eax + 0x88], ecx
mov dword [eax + 0x8c], ecx
mov dword [eax + 0x90], ecx
mov dword [eax + 0x98], ecx
mov dword [eax + 0x9c], ecx
mov dword [eax + 0xa0], ecx
mov dword [eax + 0xa8], ecx
mov dword [eax + 0xac], ecx
mov dword [eax + 0xb0], ecx
mov dword [eax + 0xb8], ecx
mov dword [eax + 0xbc], ecx
mov dword [eax + 0xc0], ecx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret

Function at 0x4347c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4b9634
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4eb86c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
sub eax, 0x10
push eax
call fcn.00403380
add eax, 0x10
mov dword [esi], eax
mov eax, dword [edi + 4]
sub eax, 0x10
push eax
mov dword [esp + 0x20], 0
call fcn.00403380
add eax, 0x10
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
sub eax, 0x10
push eax
mov byte [esp + 0x24], 1
call fcn.00403380
add eax, 0x10
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
sub eax, 0x10
push eax
mov byte [esp + 0x28], 2
call fcn.00403380
add eax, 0x10
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
sub eax, 0x10
push eax
mov byte [esp + 0x2c], 3
call fcn.00403380
add eax, 0x10
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
sub eax, 0x10
push eax
mov byte [esp + 0x30], 4
call fcn.00403380
add esp, 0x18
add eax, 0x10
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov cl, byte [edi + 0x1c]
mov byte [esi + 0x1c], cl
mov edx, dword [edi + 0x20]
mov dword [esi + 0x20], edx
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x449010
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4bb280
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4eb86c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
mov dword [esp + 0x14], edi
mov ebx, dword [esp + 0x34]
push ebx
lea ecx, [esp + 0x18]
call fcn.00405b00
mov ebp, dword [esi + 0x10]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
add esi, 0xc
push ecx
mov ecx, esi
mov dword [esp + 0x30], edi
call fcn.00445c90
mov edi, eax
mov eax, dword [edi]
test eax, eax
je 0x449074
cmp eax, esi
je 0x449079
call fcn.00488c34
cmp dword [edi + 4], ebp
mov eax, dword [esp + 0x14]
sete byte [esp + 0x34]
or edi, 0xffffffff
add eax, 0xfffffff0
mov dword [esp + 0x28], edi
lea edx, [eax + 0xc]
mov ecx, edi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4490a7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [esp + 0x34], 0
je 0x4490d7
call fcn.0045a356
test eax, eax
jne 0x4490c1
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
mov ecx, eax
mov eax, dword [esp + 0x30]
add ecx, 0x10
mov dword [eax], ecx
jmp 0x44912f
push ebx
lea ecx, [esp + 0x38]
call fcn.00405b00
lea edx, [esp + 0x34]
push edx
mov ecx, esi
mov dword [esp + 0x2c], 1
call fcn.00447090
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00403380
mov esi, dword [esp + 0x34]
add eax, 0x10
mov dword [esi], eax
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
add esp, 4
mov dword [esp + 0x28], edi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x44912d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x44bf00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4bb5bb
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x4eb86c]
xor eax, esp
mov dword [esp + 0x74], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4eb86c]
xor eax, esp
push eax
lea eax, [esp + 0x8c]
mov dword fs:[0], eax
xor ebx, ebx
mov esi, 7
mov ebp, ecx
mov dword [esp + 0x84], esi
mov dword [esp + 0x80], ebx
mov word [esp + 0x70], bx
push ebx
lea eax, [ebp + 0x380]
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x9c], ebx
call fcn.00417a90
lea ecx, [esp + 0x14]
mov byte [esp + 0x94], 1
call fcn.004178e0
test al, al
lea edi, [esi + 1]
je 0x44c086
mov dword [esp + 0x68], esi
mov dword [esp + 0x64], ebx
mov word [esp + 0x54], bx
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x18]
mov byte [esp + 0x98], 2
call fcn.00417b60
test al, al
je 0x44c073
push 2
push 0x4c79dc
lea ecx, [esp + 0x3c]
mov dword [esp + 0x54], esi
mov dword [esp + 0x50], ebx
mov word [esp + 0x40], bx
call fcn.00404ea0
push 1
push 0x4c79d8
lea ecx, [esp + 0x20]
mov byte [esp + 0x9c], 3
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], bx
call fcn.00404ea0
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x58]
push ecx
mov byte [esp + 0xa0], 4
call fcn.004578b0
add esp, 0xc
cmp dword [esp + 0x30], edi
jb 0x44c024
mov edx, dword [esp + 0x1c]
push edx
call fcn.00458aee
add esp, 4
cmp dword [esp + 0x4c], edi
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], bx
mov byte [esp + 0x94], 2
jb 0x44c04c
mov eax, dword [esp + 0x38]
push eax
call fcn.00458aee
add esp, 4
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x58]
push ecx
lea ecx, [esp + 0x78]
call fcn.00404510
lea edx, [esp + 0x50]
push edx
lea ecx, [esp + 0x18]
call fcn.00417b60
test al, al
jne 0x44bfb0
cmp dword [esp + 0x68], edi
jb 0x44c086
mov eax, dword [esp + 0x54]
push eax
call fcn.00458aee
add esp, 4
lea ecx, [esp + 0x14]
mov byte [esp + 0x94], bl
call fcn.00417960
cmp dword [esp + 0x84], edi
mov eax, dword [esp + 0x70]
jae 0x44c0a7
lea eax, [esp + 0x70]
push eax
lea ecx, [ebp + 0x74]
call fcn.00460323
cmp dword [esp + 0x84], edi
jb 0x44c0c6
mov ecx, dword [esp + 0x70]
push ecx
call fcn.00458aee
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x8c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.004888ae
add esp, 0x84
ret
Function at 0x44e870
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4bb95b
mov eax, dword fs:[0]
push eax
sub esp, 0x818
mov eax, dword [0x4eb86c]
xor eax, esp
mov dword [esp + 0x814], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4eb86c]
xor eax, esp
push eax
lea eax, [esp + 0x82c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x83c]
push str.DevUtil::UnRegisterDriver
lea ecx, [esp + 0x18]
call fcn.00405a40
xor ebx, ebx
push str.SETUPAPI.DLL
mov dword [esp + 0x838], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebp, eax
cmp ebp, ebx
je 0x44e966
push str.SetupUninstallOEMInfW
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, ebx
je 0x44e94a
push ebx
push 1
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
call edi
test eax, eax
je 0x44e923
push esi
push str._INFO_SetupUninstallOEMInf_Succeeded_:_s_n
call fcn.0044f300
push eax
call fcn.0044fb20
add esp, 0xc
push ebp
mov bl, 1
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x44ea47
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
push str._ERROR_SetupUninstallOEMInf_Failed__x__:__s_n
call fcn.0044f300
push eax
call fcn.0044fb20
add esp, 0x10
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x44ea47
push str._ERROR_GetProcAddress_SetupUninstallOEMInf__failed_n
call fcn.0044f300
push eax
call fcn.0044fb20
add esp, 8
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x44e979
push str._ERROR_LoadLibrary_failed_n
call fcn.0044f300
push eax
call fcn.0044fb20
add esp, 8
push str._INFO_SetupUninstallOEMInf_function_is_not_supported__delete_file_directly_n
call fcn.0044f300
push eax
call fcn.0044fb20
add esp, 8
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
je 0x44ea34
push 0x100
lea eax, [esp + 0x62c]
push eax
push 0x100
lea ecx, [esp + 0x2c]
push ecx
push 0x100
lea edx, [esp + 0x43c]
push edx
push 3
lea eax, [esp + 0x34]
push eax
push esi
call fcn.0048a66b
push str..PNF
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x454]
push edx
lea eax, [esp + 0x48]
push eax
push str._s_s_s_s
lea ecx, [esp + 0x258]
push 0x208
push ecx
call fcn.004032e0
add esp, 0x40
lea edx, [esp + 0x220]
push edx
call edi
test eax, eax
je 0x44ea2d
push str._INFO_Delete_INF_PNF_succeeded_n
call fcn.0044f300
push eax
call fcn.0044fb20
mov bl, 1
jmp 0x44ea44
push str._ERROR_Delete_PNF_failed_n
jmp 0x44ea39
push str._ERROR_Delete_INF_failed_n
call fcn.0044f300
push eax
call fcn.0044fb20
add esp, 8
lea ecx, [esp + 0x14]
mov dword [esp + 0x834], 0xffffffff
call fcn.00403f90
mov al, bl
mov ecx, dword [esp + 0x82c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x814]
xor ecx, esp
call fcn.004888ae
add esp, 0x824
ret
Function at 0x44f3f0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4eb86c]
xor eax, esp
mov dword [esp + 0x208], eax
mov eax, dword [esp + 0x210]
push esi
push edi
push eax
mov esi, ecx
push 0x208
lea ecx, [esp + 0x10]
push ecx
call fcn.00401e30
push str.logsetting.ini
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea eax, [esp + 8]
push eax
push 0
push str.LogLevel
push str.Setting
call edi
lea ecx, [esp + 8]
push ecx
push 0
push str.DebugOut
push str.Setting
mov dword [esi], eax
call edi
mov ecx, dword [esp + 0x210]
pop edi
mov dword [esi + 4], eax
pop esi
xor ecx, esp
call fcn.004888ae
add esp, 0x20c
ret 4

Function at 0x44f6f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4eb86c]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
mov esi, dword [esp + 0x214]
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x44f76b
push str.epsonessetup
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x44f76b
lea edx, [esp + 4]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
lea eax, [esp + 4]
push eax
mov ecx, esi
call fcn.00401840
mov eax, 1
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.004888ae
add esp, 0x20c
ret 4
mov ecx, dword [esp + 0x20c]
pop esi
xor ecx, esp
xor eax, eax
call fcn.004888ae
add esp, 0x20c
ret 4
Function at 0x44fe80
Capabilities:
Create directory

Disassembly:
sub esp, 0x210
mov eax, dword [0x4eb86c]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push edi
mov edi, dword [esp + 0x21c]
xor ebx, ebx
push 0x206
lea eax, [esp + 0x12]
push ebx
push eax
mov word [esp + 0x18], bx
call fcn.00489e60
push edi
call fcn.0044fe20
add esp, 0x10
test al, 2
je 0x44feda
pop edi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004888ae
add esp, 0x210
ret
push ebp
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x44ff71
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x44ffaf
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
call ebp
add eax, 1
test eax, eax
jle 0x44ff71
lea eax, [esp + 0x14]
sub eax, edi
mov esi, edi
mov dword [esp + 0x10], eax
movzx eax, word [esi]
cmp ax, 0x5c
je 0x44ff25
test ax, ax
jne 0x44ff56
lea ecx, [esp + 0x14]
push ecx
call ebp
cmp word [esp + eax*2 + 0x12], 0x3a
je 0x44ff56
lea edx, [esp + 0x14]
push edx
call fcn.0044fe20
add esp, 4
test al, 2
jne 0x44ff56
push 0
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x44ff8c
mov cx, word [esi]
mov edx, dword [esp + 0x10]
mov word [edx + esi], cx
push edi
add ebx, 1
add esi, 2
call ebp
add eax, 1
cmp ebx, eax
jl 0x44ff17
mov al, 1
mov ecx, dword [esp + 0x21c]
pop esi
pop ebp
pop edi
pop ebx
xor ecx, esp
call fcn.004888ae
add esp, 0x210
ret
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ERROR_CreateDirectrory_failed__x_:_s_n
call fcn.0044f300
push eax
call fcn.0044fb20
add esp, 0x10
xor al, al
jmp 0x44ff73
push eax
push edi
push str._ERROR_CreateDirectrory_failed:_s__x__n
jmp 0x44ff9d

Function at 0x44ffc0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x2c
push ebx
push ebp
mov ebp, dword [esp + 0x38]
push esi
push edi
lea eax, [esp + 0x18]
push eax
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x45003d
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
push 0
push 0
lea ecx, [esp + 0x18]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x45002e
mov edx, dword [esp + 0x14]
cmp edx, edi
ja 0x450058
jb 0x45000f
mov eax, dword [esp + 0x10]
cmp eax, ebx
jae 0x450058
push ebp
push esi
push str._ERROR_Free_Disk_Space_is_smaller:_s_for__s_n
call fcn.0044f300
push eax
call fcn.0044fb20
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x2c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str._ERROR_GetDiskFreeSpaceEx_failed:_s__x__n
jmp 0x45004a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebp
push str._ERROR_GetFileAttributesEx_failed_for_Source_File:__s__x__n
call fcn.0044f300
push eax
call fcn.0044fb20
add esp, 0x10
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x2c
ret
Function at 0x450070
Capabilities:
Copy file
Get common file path
Move file

Disassembly:
sub esp, 0x220
mov eax, dword [0x4eb86c]
xor eax, esp
mov dword [esp + 0x21c], eax
mov ecx, dword [str._ESTMP]
mov eax, dword [esp + 0x230]
mov edx, dword [0x4c9dfc]
push ebx
mov ebx, dword [esp + 0x230]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileW]
push esi
mov esi, dword [esp + 0x230]
push edi
mov edi, dword [esp + 0x238]
push 0
mov dword [esp + 0x14], eax
mov eax, dword [0x4c9e00]
mov dword [esp + 0x18], ecx
mov cx, word [0x4c9e04]
push edi
push esi
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], cx
call ebp
test eax, eax
jne 0x450139
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x4501a4
lea edx, [esp + 0x24]
push edx
push 0
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x450195
push 0
lea ecx, [esp + 0x28]
push ecx
push esi
call ebp
test eax, eax
je 0x450171
push 5
push edi
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x450154
mov eax, dword [esp + 0x10]
test eax, eax
je 0x450139
mov dword [eax], 1
mov al, 1
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004888ae
add esp, 0x220
ret
push edi
lea eax, [esp + 0x28]
push eax
push str._ERROR_Failed_to_set_overwrite_frag_on_reboot:_s_to__s_n
call fcn.0044f300
push eax
call fcn.0044fb20
add esp, 0x10
xor al, al
jmp 0x45013b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x28]
push ecx
push esi
push str._ERROR_Copy_Failed_Temp_:_s_to__s__x__n
call fcn.0044f300
push eax
call fcn.0044fb20
add esp, 0x14
xor al, al
jmp 0x45013b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str._ERROR_Failed_to_get_temp_file_name_for_source:_s__x__n
jmp 0x45015f
push eax
push edi
push esi
push str._ERROR_Copy_Failed:_s_to__s__x__n
call fcn.0044f300
push eax
call fcn.0044fb20
add esp, 0x14
xor al, al
jmp 0x45013b

Function at 0x4501d0
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x450258
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 2
je 0x450258
cmp eax, 5
jne 0x450243
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
push esi
je 0x450228
push str._INFO_File_will_be_removed_after_reboot:_s_n
call fcn.0044f300
push eax
call fcn.0044fb20
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
je 0x450258
pop edi
mov dword [eax], 1
mov al, 1
pop esi
ret
call edi
push eax
push str._ERROR_Failed_to_set_delete_on_reboot__x_:_s_n
call fcn.0044f300
push eax
call fcn.0044fb20
add esp, 0x10
pop edi
xor al, al
pop esi
ret
push eax
push esi
push str._ERROR_Failed_to_remove_file:__s__x__n
call fcn.0044f300
push eax
call fcn.0044fb20
add esp, 0x10
pop edi
mov al, 1
pop esi
ret
Function at 0x450360
Capabilities:
Get file version info

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor ebp, ebp
push ebp
push edi
mov dword [ebx], ebp
mov dword [ebx + 4], ebp
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebp
jbe 0x45041c
push esi
call fcn.00488a0f
add esp, 4
test eax, eax
mov dword [esp + 0x20], eax
je 0x45045b
push eax
push esi
push ebp
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x450405
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0x4c3c24
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4503f1
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 8]
mov dword [ebx + 4], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x20]
push eax
mov dword [ebx], edx
mov ebp, 1
call fcn.004888bd
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 8
ret
push edi
push str._INFO_Could_not_get_file_version:_s_n
call fcn.0044f300
push eax
call fcn.0044fb20
add esp, 0xc
mov eax, dword [esp + 0x20]
push eax
call fcn.004888bd
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x714
push edi
jne 0x450447
push str._INFO_File_doesnt_have_resource:_s_n
call fcn.0044f300
push eax
call fcn.0044fb20
add esp, 0xc
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 8
ret
push eax
push str._ERROR_Failed_to_get_version_info__x_:_s_n
call fcn.0044f300
push eax
call fcn.0044fb20
add esp, 0x10
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4505d0
Capabilities:
Check if file exists
Delete directory
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
sub esp, 0x664
mov eax, dword [0x4eb86c]
xor eax, esp
mov dword [esp + 0x660], eax
push esi
mov esi, dword [esp + 0x66c]
test esi, esi
push edi
mov edi, dword [esp + 0x674]
je 0x450799
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x450799
push ebx
push esi
push str._s.
lea eax, [esp + 0x46c]
push 0x208
push eax
call fcn.004032e0
add esp, 0x10
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x468]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4506d2
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea esp, [esp]
push 0x4c15f0
lea eax, [esp + 0x40]
push eax
call ebp
test eax, eax
je 0x4506ba
push 0x4c3418
lea ecx, [esp + 0x40]
push ecx
call ebp
test eax, eax
je 0x4506ba
test byte [esp + 0x10], 0x10
lea edx, [esp + 0x3c]
push edx
push esi
push str._s_s
lea eax, [esp + 0x26c]
push 0x208
push eax
je 0x4506a4
call fcn.004032e0
lea ecx, [esp + 0x274]
push edi
push ecx
call fcn.004505d0
jmp 0x4506b7
call fcn.004032e0
lea ecx, [esp + 0x274]
push edi
push ecx
call fcn.004501d0
add esp, 0x1c
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x450650
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
pop ebx
jne 0x45076c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x450780
cmp eax, 0x91
jne 0x45073e
push esi
push str._INFO_Directory_will_be_removed_after_reboot:_s_n
call fcn.0044f300
push eax
call fcn.0044fb20
add esp, 0xc
push 5
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x450780
test edi, edi
je 0x450780
mov dword [edi], 1
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x660]
xor ecx, esp
call fcn.004888ae
add esp, 0x664
ret
push eax
push esi
push str._ERROR_Failed_to_remove_directory:_s__x__n
call fcn.0044f300
push eax
call fcn.0044fb20
add esp, 0x10
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x660]
xor ecx, esp
call fcn.004888ae
add esp, 0x664
ret
push esi
push str._INFO_Directory_is_removed:_s_n
call fcn.0044f300
push eax
call fcn.0044fb20
add esp, 0xc
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x660]
xor ecx, esp
call fcn.004888ae
add esp, 0x664
ret
mov ecx, dword [esp + 0x668]
pop edi
pop esi
xor ecx, esp
xor al, al
call fcn.004888ae
add esp, 0x664
ret
Function at 0x454580
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4bc2d0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4eb86c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov eax, dword [esp + 0x38]
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], esi
call fcn.00405b00
mov ecx, dword [esp + 0x40]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x3c], 1
call fcn.00453fa0
mov ebp, eax
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
add esp, 0xc
mov byte [esp + 0x30], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45460a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp ebp, esi
mov dword [esp + 0x14], esi
jle 0x454656
mov ebx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x45462b
mov eax, dword [esp + 0x20]
sub eax, ecx
sar eax, 2
cmp esi, eax
jb 0x454634
call fcn.00488c34
mov ecx, dword [esp + 0x1c]
lea edi, [ecx + esi*4]
lea ecx, [esp + 0x14]
push ecx
mov ecx, ebx
call fcn.00428490
push edi
mov ecx, eax
call fcn.004047c0
add esi, 1
cmp esi, ebp
mov dword [esp + 0x14], esi
jl 0x454616
mov eax, dword [esp + 0x1c]
test eax, eax
mov dword [esp + 0x30], 0xffffffff
je 0x454688
mov edx, dword [esp + 0x14]
push edx
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x1c]
push ecx
push edx
push eax
call fcn.0040d020
mov eax, dword [esp + 0x2c]
push eax
call fcn.00458aee
add esp, 0x14
mov eax, ebp
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x4550d0
Capabilities:
Set registry value

Disassembly:
push ecx
mov cl, byte [esp + 0x18]
push ebx
mov edx, dword [esp + 0x10]
xor ebx, ebx
neg cl
push ebx
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x14]
push ebx
mov dword [esp + 0x10], ebx
sbb ecx, ecx
and ecx, 0xffffff00
add ecx, 0x200
or ecx, 2
push ecx
push ebx
push ebx
push ebx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x455145
push esi
mov esi, dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [esp + 0x18]
lea ecx, [eax + eax + 2]
mov eax, dword [esp + 8]
push ecx
push esi
push 1
push ebx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
pop esi
jne 0x45513a
mov bl, 1
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
pop ecx
ret