joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4510f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55afbd
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x60b3c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x40]
push 7
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
push 0x5ec8d8
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0
call fcn.00417cb0
push esi
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0
call fcn.00417300
mov dword [ebp - 0x18], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0x10
jb 0x4511b7
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4511ad
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x451215
push ecx
push edx
call fcn.0050fd95
add esp, 8
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x4511f9
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4511ef
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45121a
push ecx
push edx
call fcn.0050fd95
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050fd4b
mov esp, ebp
pop ebp
ret 4
call fcn.0052865a
call fcn.0052865a
int3

Function at 0x451220
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55affd
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x60b3c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x44]
push 7
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
push str.Error:
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x30], 0
call fcn.00417c00
mov eax, esi
mov dword [ebp - 4], 0
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x451280
sub eax, edx
lea ecx, [ebp - 0x44]
sar eax, 1
push eax
push esi
call fcn.0041b8d0
mov dword [ebp - 0x18], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
lea ecx, [ebp - 0x44]
call fcn.00417680
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x28]
call fcn.00417680
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050fd4b
mov esp, ebp
pop ebp
ret 4
Function at 0x451310
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55affd
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x60b3c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x44]
push 5
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
push str.Log:
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x30], 0
call fcn.00417c00
mov eax, esi
mov dword [ebp - 4], 0
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x451370
sub eax, edx
lea ecx, [ebp - 0x44]
sar eax, 1
push eax
push esi
call fcn.0041b8d0
mov dword [ebp - 0x18], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
lea ecx, [ebp - 0x44]
call fcn.00417680
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x28]
call fcn.00417680
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050fd4b
mov esp, ebp
pop ebp
ret 4

Function at 0x451400
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55affd
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x60b3c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x44]
push 7
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
push str.Debug:
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x30], 0
call fcn.00417c00
mov eax, esi
mov dword [ebp - 4], 0
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x451460
sub eax, edx
lea ecx, [ebp - 0x44]
sar eax, 1
push eax
push esi
call fcn.0041b8d0
mov dword [ebp - 0x18], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
lea ecx, [ebp - 0x44]
call fcn.00417680
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x28]
call fcn.00417680
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050fd4b
mov esp, ebp
pop ebp
ret 4
Function at 0x4514f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55afbd
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x60b3c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x40]
push 8
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
push str.state:_r_n
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0
call fcn.00417cb0
push esi
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0
call fcn.00417300
mov dword [ebp - 0x18], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0x10
jb 0x4515b7
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4515ad
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x451615
push ecx
push edx
call fcn.0050fd95
add esp, 8
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x4515f9
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4515ef
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45161a
push ecx
push edx
call fcn.0050fd95
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050fd4b
mov esp, ebp
pop ebp
ret 4
call fcn.0052865a
call fcn.0052865a
int3
Function at 0x455b20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55b580
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x60b3c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00455d20
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x455b84
mov byte [ebp - 0x91], 1
jmp 0x455ceb
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004f6b00
add esp, 4
test al, al
jne 0x455ba7
mov byte [ebp - 0x91], al
jmp 0x455ceb
push 0x50
lea eax, [ebp - 0x78]
push 0
push eax
call fcn.00512700
push 0x30
lea eax, [ebp - 0x70]
mov dword [ebp - 0x78], vtable.NInstaller::CCatalogCabParser.0
push 0
push eax
call fcn.00512700
xorps xmm0, xmm0
mov dword [ebp - 0x70], 0
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
mov ecx, esp
push eax
call fcn.0041b1f0
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x78]
call fcn.00456a00
lea eax, [ebp - 0x90]
mov byte [ebp - 4], 2
push eax
mov ecx, esi
call fcn.00456c50
lea ecx, [ebp - 0x90]
mov byte [ebp - 0x91], al
call fcn.00417680
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x78], vtable.NInstaller::CCatalogCabParser.0
cmp ecx, 0x10
jb 0x455c80
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x455c76
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x455d15
push ecx
push edx
call fcn.0050fd95
add esp, 8
mov eax, dword [ebp - 0x68]
xor esi, esi
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
test eax, eax
je 0x455cb4
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
jne 0x455cad
call fcn.0044e1c0
mov esi, eax
mov dword [ebp - 0x68], 0
mov eax, dword [ebp - 0x60]
test eax, eax
je 0x455cd6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x455ccf
test esi, esi
js 0x455ccf
call fcn.0044e1c0
mov dword [ebp - 0x60], 0
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x455ceb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x70], 0
lea ecx, [ebp - 0x28]
call fcn.00417680
mov al, byte [ebp - 0x91]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050fd4b
mov esp, ebp
pop ebp
ret 4
call fcn.0052865a
int3
Function at 0x457640
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55b89b
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x60b3c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x80]
mov esi, dword [ebp + 0xc]
push 0x40
push 0
mov dword [ebp - 0x88], edi
push eax
mov dword [ebp - 0x84], vtable.CMD5Checksum.0
call fcn.00512700
add esp, 0xc
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x38], 0x67452301
mov dword [ebp - 0x34], 0xefcdab89
mov dword [ebp - 0x30], 0x98badcfe
mov dword [ebp - 0x2c], 0x10325476
push dword [ebp + 0x10]
lea ecx, [ebp - 0x84]
mov dword [ebp - 4], 0
push esi
call fcn.004594a0
xorps xmm0, xmm0
lea ecx, [ebp - 0x3f]
movups xmmword [ebp - 0x28], xmm0
xor edx, edx
nop
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x18], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x17], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x16], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x15], al
add edx, 4
cmp edx, 8
jb 0x4576e0
mov edx, dword [ebp - 0x40]
mov ecx, 0x78
shr edx, 3
mov eax, 0x38
and edx, 0x3f
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovae eax, ecx
lea ecx, [ebp - 0x84]
push eax
push 0x60cc68
call fcn.004594a0
push 8
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x84]
call fcn.004594a0
xor edx, edx
lea ecx, [ebp - 0x37]
nop
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x28], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x27], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x26], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x25], al
add edx, 4
cmp edx, 0x10
jb 0x457750
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x88]
call fcn.00459140
mov byte [ebp - 4], 1
xorps xmm0, xmm0
mov esi, dword [ebp - 0x88]
mov ecx, esi
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4577b0
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.00417c00
add esi, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [esi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4577e2
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
mov edx, dword [edx + 4]
call edx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050fd4b
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4589c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x458a1b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x458a1b
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x458a08
cmp esi, edx
jae 0x458a1b
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x4589f6
cmp esi, edx
jae 0x458a1b
xor eax, eax
cmp word [esi], ax
pop edi
cmove esi, eax
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x45cd30
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55c0db
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x250
mov eax, dword [0x60b3c4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x230], edx
mov esi, ecx
push 0x208
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.00512700
add esp, 0xc
lea eax, [ebp - 0x220]
push 1
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x45cf7f
sub esp, 8
mov eax, esp
sub esp, 8
mov edx, esp
mov dword [eax], str.McAfee
mov dword [eax + 4], 6
lea eax, [ebp - 0x220]
mov ecx, eax
mov dword [edx], eax
lea edi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45cdd0
sub ecx, edi
sar ecx, 1
mov dword [edx + 4], ecx
lea ecx, [ebp - 0x248]
call fcn.0045cbb0
mov edi, eax
add esp, 0x10
cmp esi, edi
je 0x45ce20
mov ecx, esi
call fcn.00417680
movups xmm0, xmmword [edi]
xor eax, eax
movups xmmword [esi], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
lea ecx, [ebp - 0x248]
call fcn.00417680
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x45ce35
mov eax, dword [esi]
mov byte [ebp - 0x22c], 0
lea edx, [ebp - 0x228]
push dword [ebp - 0x22c]
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x228], eax
call fcn.0045e050
mov edx, dword [ebp - 0x230]
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], 0
call fcn.0045d790
add esp, 4
mov byte [ebp - 0x221], al
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], 0xffffffff
call fcn.00417680
cmp byte [ebp - 0x221], 0
je 0x45cf7f
sub esp, 8
mov ecx, esi
mov eax, esp
mov dword [eax], str.WebAdvisor
mov dword [eax + 4], 0xa
cmp dword [esi + 0x14], 8
jb 0x45ceb5
mov ecx, dword [esi]
sub esp, 8
lea edi, [ecx + 2]
mov edx, esp
mov dword [edx], ecx
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45cec0
sub ecx, edi
sar ecx, 1
mov dword [edx + 4], ecx
lea ecx, [ebp - 0x248]
call fcn.0045cbb0
mov edi, eax
add esp, 0x10
cmp esi, edi
je 0x45cf10
mov ecx, esi
call fcn.00417680
movups xmm0, xmmword [edi]
xor eax, eax
movups xmmword [esi], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
lea ecx, [ebp - 0x248]
call fcn.00417680
cmp dword [esi + 0x14], 8
jb 0x45cf23
mov esi, dword [esi]
mov byte [ebp - 0x228], 0
lea edx, [ebp - 0x22c]
push dword [ebp - 0x228]
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x22c], esi
call fcn.0045e050
mov edx, dword [ebp - 0x230]
lea ecx, [ebp - 0x260]
mov dword [ebp - 4], 1
call fcn.0045d790
add esp, 4
mov byte [ebp - 0x221], al
lea ecx, [ebp - 0x260]
call fcn.00417680
cmp byte [ebp - 0x221], 0
setne al
jmp 0x45cf81
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0050fd4b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x45d6e0
Capabilities:
Get common file path
Get program files directory

Disassembly:
sub esp, 0x20c
mov eax, dword [0x60b3c4]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
push 0x208
lea eax, [esp + 8]
mov esi, ecx
push 0
push eax
call fcn.00512700
add esp, 0xc
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x45d73a
xor al, al
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0050fd4b
add esp, 0x20c
ret
lea eax, [esp + 4]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x45d741
sub eax, edx
mov ecx, esi
sar eax, 1
push eax
lea eax, [esp + 8]
push eax
call fcn.0041ba30
push 0x12
push str.McAfeeWebadvisor
mov ecx, esi
call fcn.0041b8d0
mov ecx, dword [esp + 0x20c]
mov al, 1
pop esi
xor ecx, esp
call fcn.0050fd4b
add esp, 0x20c
ret

Function at 0x45d790
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55c20d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x60b3c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, edx
mov esi, ecx
mov dword [ebp - 4], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x45d7d0
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45d819
test eax, 0x400
je 0x45d819
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x45d7ed
mov eax, dword [esi]
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
push dword [ebp - 0x18]
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x1c], eax
call fcn.0045e050
add esp, 4
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.0045c790
lea ecx, [ebp - 0x34]
call fcn.00417680
cmp dword [esi + 0x14], 8
jb 0x45d821
mov esi, dword [esi]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x45d854
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x45d854
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45ff90
Capabilities:
Get session information
Get session user name
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55c81e
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x60b3c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0
push 7
movups xmmword [esi], xmm0
push 0x5ed2a0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00417c00
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp eax, 0xffffffff
jne 0x46001d
push str.Error_retrieving_session_id_for_generating_log_name.
jmp 0x460075
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push 5
push eax
push 0
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x460070
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x460070
mov eax, dword [ebp - 0x14]
cmp eax, 2
jbe 0x46005a
shr eax, 1
dec eax
push eax
push ecx
mov ecx, esi
call fcn.0041ba30
push dword [ebp - 0x18]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
jmp 0x46007b
push str.WTSQuerySessionInformation_failed_to_retrieve_the_size_of_the_current_user_name_for_the_log_name.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push dword [ebp - 0x18]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
jmp 0x46007b
push str.WTSQuerySessionInformation_failed_to_retrieve_current_user_name_for_the_log_name.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050fd4b
mov esp, ebp
pop ebp
ret
Function at 0x462bd0
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x60b3c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x462d51
cmp dword [ebp - 0x1c], 0
mov cl, 1
mov edi, dword [ebp - 0xc]
setne al
mov byte [ebp - 0x14], al
movzx eax, cl
mov byte [ebp - 8], cl
sub eax, 0
jne 0x462c45
test edi, edi
je 0x462c45
mov eax, dword [edi]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x585534]
mov ecx, edi
call esi
xor eax, eax
mov word [ebp - 0x18], ax
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process2]
test eax, eax
je 0x462d74
mov ax, word [ebp - 0x18]
movzx esi, word [ebp - 0x1c]
test ax, ax
mov edi, dword [ebp - 0xc]
mov edx, esi
movzx ecx, ax
cmovne edx, ecx
mov dword [ebp - 0x10], esi
mov cl, 1
mov dword [ebp - 0x14], edx
movzx eax, cl
mov byte [ebp - 8], cl
sub eax, 0
jne 0x462cab
test edi, edi
je 0x462cab
mov eax, dword [edi]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x585534]
mov ecx, edi
call esi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x50]
test eax, eax
jne 0x462d97
mov eax, 0x7ffe0030
push 0
push 0x2000000
push 3
push 0
push 7
push 0x100080
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x462d06
push 0
push 0x100
push 0x60d440
push esi
call dword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
test eax, eax
jne 0x462d1b
test esi, esi
je 0x462d06
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050fd4b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
cmp eax, 0x100
jae 0x462cfb
mov dword [0x60d640], 0x60d440
mov dword [0x60d644], eax
test esi, esi
je 0x462d3c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0050fd4b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor cl, cl
mov dword [ebp - 0xc], 0
xor edi, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x61d9d0
mov dword [ebp - 0xc], edi
jmp 0x462c24
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor cl, cl
mov dword [ebp - 0xc], 0
xor edi, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x61d9d0
mov dword [ebp - 0xc], edi
jmp 0x462c8a
add eax, 0x1e
jmp 0x462cc4