joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447df3
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x894
push ebx
push ebp
push esi
push edi
push 0x428
lea eax, [esp + 0x47c]
mov ebx, ecx
push 0
push eax
call fcn.0041c9b0
add esp, 0xc
mov dword [esp + 0x10], 0x4679a8
lea eax, [esp + 0x58]
or esi, 0xffffffff
lea ecx, [esp + 0x48]
mov dword [esp + 0x14], esi
push dword [esp + 0x8ac]
push 0x104
push eax
call fcn.0040323f
mov edi, dword [esp + 0x8a8]
mov dword [esp + 0x48], 0x46cfd4
test edi, edi
je 0x448031
cmp dword [esp + 0x8ac], 0
je 0x448031
lea eax, [esp + 0x24]
xor ebp, ebp
push eax
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x448031
push edi
push 0x104
lea eax, [esp + 0x278]
push eax
lea ecx, [esp + 0x26c]
call fcn.0040323f
mov dword [esp + 0x260], 0x46cfd4
cmp dword [esp + 0x268], ebp
jbe 0x448031
push ecx
push 3
push 1
push closesocket
push dword [esp + 0x274]
lea ecx, [esp + 0x24]
call fcn.00401442
test al, al
je 0x44802d
lea eax, [esp + 0x478]
push eax
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov esi, dword [esp + 0x14]
xorps xmm0, xmm0
mov eax, dword [esp + 0x24]
mov dword [esp + 0x488], ebp
mov dword [esp + 0x490], eax
mov dword [esp + 0x48c], ebp
movlpd qword [esp + 0x18], xmm0
cmp esi, 0xffffffff
je 0x447f1d
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x447f26
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x50]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x898], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x89c], ecx
test edx, edx
je 0x447f6d
test eax, eax
je 0x447f89
mov ecx, ebp
test edx, edx
je 0x447f6d
cmp word [eax + ecx*2], 0x5c
jne 0x447f68
push 0x2f
pop edx
mov word [eax + ecx*2], dx
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x4c]
inc ecx
cmp ecx, edx
jb 0x447f52
test eax, eax
je 0x447f89
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x49c]
push 0x200
push eax
call fcn.004290da
add esp, 0x10
lea eax, [esp + 0x478]
mov ecx, ebx
push eax
call fcn.0044772d
test al, al
je 0x448031
cmp dword [ebx + 0x2b0], ebp
jne 0x447fc3
push 0x45f8cc
push 0x400080
call fcn.0041aafd
mov dword [ebx + 0x2b0], eax
pop ecx
pop ecx
test eax, eax
je 0x448031
mov ebp, dword [ebx + 0x2b0]
cmp esi, 0xffffffff
je 0x448022
test ebp, ebp
je 0x448022
xor edi, edi
and dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push 0
push eax
mov eax, 0x400000
sub eax, edi
push eax
lea eax, [edi + ebp]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44800a
cmp dword [esp + 0x10], 0
je 0x44800a
add edi, dword [esp + 0x10]
cmp edi, 0x400000
jb 0x447fd4
test edi, edi
je 0x448022
push edi
push dword [ebx + 0x2b0]
mov ecx, ebx
call fcn.0044766a
test al, al
jne 0x447fc3
jmp 0x448031
mov ecx, ebx
call fcn.00447301
mov bl, al
jmp 0x448033
mov esi, dword [esp + 0x14]
xor bl, bl
and dword [esp + 0x4c], 0
and dword [esp + 0x50], 0
mov dword [esp + 0x48], 0x4654d8
cmp esi, 0xffffffff
je 0x448051
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x894
ret 8
Function at 0x448ae7
Capabilities:
Create process on windows
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
lea eax, [ebp - 0x244]
push ebx
push edi
mov ebx, 0x208
xor edi, edi
push ebx
push edi
push eax
call fcn.0041c9b0
add esp, 0xc
lea eax, [ebp - 0x244]
push eax
push edi
push edi
push 0x26
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [ebp - 0x244]
call fcn.0040f3ea
test al, al
jne 0x448b9e
call fcn.0040951b
test al, al
je 0x448b9e
call fcn.004094be
test al, al
jne 0x448b9e
push 0x3c
lea eax, [ebp - 0x3c]
push edi
push eax
call fcn.0041c9b0
push ebx
lea eax, [ebp - 0x44c]
push edi
push eax
call fcn.0041c9b0
add esp, 0x18
mov dword [ebp - 0x3c], 0x3c
lea eax, [ebp - 0x44c]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0x4679ec
push 0x103
push eax
push edi
mov dword [ebp - 0x30], 0x4711f0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
neg eax
sbb al, al
inc al
jmp 0x448ba0
mov al, 1
pop edi
pop ebx
leave
ret
Function at 0x44a5c1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, ecx
call fcn.0044a587
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [esi + 0x118], eax
cmp eax, 0x390
jae 0x44a5ef
and dword [esi + 0x118], 0
xor al, al
jmp 0x44a62f
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [esi + 0x110], eax
test eax, eax
je 0x44a5e4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esi + 0x114], eax
test eax, eax
jne 0x44a62d
push dword [esi + 0x110]
call dword [sym.imp.KERNEL32.dll_FreeResource]
and dword [esi + 0x110], 0
jmp 0x44a5e4
mov al, 1
pop esi
ret 8

Function at 0x44b713
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Import public key
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 0
push esi
push edi
mov esi, ecx
je 0x44b782
cmp dword [ebp + 0xc], 0
je 0x44b782
cmp dword [ebp + 0x10], 0
je 0x44b782
cmp dword [ebp + 0x14], 0
je 0x44b782
mov eax, dword [esi]
test eax, eax
je 0x44b782
xor edi, edi
cmp dword [eax + 0xc], edi
je 0x44b782
push 0xf0000000
push 1
push edi
push edi
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x44b782
lea eax, [ebp - 8]
push eax
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
add eax, 0x38
push eax
push 0x10001
push dword [ebp - 4]
call dword [sym.imp.CRYPT32.dll_CryptImportPublicKeyInfo]
test eax, eax
jne 0x44b78a
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
pop edi
pop esi
leave
ret 0x10
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push 0x8004
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x44b7ad
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x44b778
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x44b7d5
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x44b778
push edi
push edi
push dword [ebp - 8]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptVerifySignatureW]
push dword [ebp - 8]
test eax, eax
je 0x44b7c4
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, 1
jmp 0x44b784
Function at 0x44c3cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, ecx
push ebx
push esi
test edx, edx
je 0x44c41d
cmp dword [ebp + 0xc], 0
xorps xmm0, xmm0
movlpd qword [ebp - 8], xmm0
jb 0x44c41d
ja 0x44c3ef
cmp dword [ebp + 8], 0
jbe 0x44c41d
mov esi, dword [ebp - 4]
xor bl, bl
mov ecx, dword [ebp - 8]
mov eax, ecx
and eax, 0xf
mov al, byte [eax*4 + 0x4698c0]
add al, bl
xor byte [ecx + edx], al
mov bl, byte [ecx + edx]
add ecx, 1
adc esi, 0
cmp esi, dword [ebp + 0xc]
jb 0x44c3f7
ja 0x44c41d
cmp ecx, dword [ebp + 8]
jb 0x44c3f7
pop esi
pop ebx
leave
ret

Function at 0x44c471
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x44c4a7
test esi, esi
je 0x44c4b2
xor edx, edx
test edi, edi
je 0x44c4b2
mov ch, dl
mov cl, byte [edx + esi]
mov eax, edx
and eax, 0xf
mov al, byte [eax + ebx]
add al, ch
mov ch, cl
xor al, cl
mov byte [edx + esi], al
inc edx
cmp edx, edi
jb 0x44c48c
jmp 0x44c4b2
push 0x4698c0
call fcn.0044c5ab
pop ecx
pop edi
pop esi
pop ebx
ret

Function at 0x44c4b6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x44c4f7
cmp dword [ebp + 0xc], 0
je 0x44c4f7
test esi, esi
je 0x44c502
xor ecx, ecx
test edi, edi
je 0x44c502
mov byte [ebp + 0xb], cl
xor edx, edx
mov eax, ecx
div dword [ebp + 0xc]
mov al, byte [edx + ebx]
add al, byte [ebp + 0xb]
xor byte [ecx + esi], al
mov al, byte [ecx + esi]
inc ecx
mov byte [ebp + 0xb], al
cmp ecx, edi
jb 0x44c4da
jmp 0x44c502
push 0x4698c0
call fcn.0044c57d
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x44c556
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov byte [ecx + 0x68], al
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x44c57d
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x44c5a9
xor ecx, ecx
test edx, edx
je 0x44c5a9
push ebx
push edi
mov edi, dword [esp + 0x10]
mov bl, cl
mov eax, ecx
and eax, 0xf
mov al, byte [edi + eax*4]
add al, bl
xor byte [ecx + esi], al
mov bl, byte [ecx + esi]
inc ecx
cmp ecx, edx
jb 0x44c592
pop edi
pop ebx
pop esi
ret

Function at 0x44c5ab
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x44c5df
xor edx, edx
test edi, edi
je 0x44c5df
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov bl, dl
mov cl, byte [edx + esi]
mov eax, edx
and eax, 0xf
mov al, byte [ebp + eax*4]
add al, bl
mov bl, cl
xor al, cl
mov byte [edx + esi], al
inc edx
cmp edx, edi
jb 0x44c5c3
pop ebp
pop ebx
pop edi
pop esi
ret
Function at 0x44c87c
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
sub esp, 0x45c
lea eax, [esp]
push ebx
push ebp
push esi
push edi
xor esi, esi
push 0x208
push esi
push eax
mov ebx, esi
call fcn.0041c9b0
mov edi, dword [esp + 0x47c]
add esp, 0xc
test edi, edi
je 0x44ca58
push 0x470f80
push edi
push 0x470f90
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.00403c23
add esp, 0x14
lea eax, [esp + 0x218]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x44ca07
test byte [esp + 0x218], 0x10
lea eax, [esp + 0x244]
je 0x44c965
push 0x46fda4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x44c9e9
push 0x470f88
lea eax, [esp + 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x44c9e9
lea eax, [esp + 0x244]
push eax
push edi
push 0x470f90
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.00403c23
add esp, 0x14
lea eax, [esp + 0x10]
mov ecx, 0x4b9168
push 1
push 1
push 0x470f80
push eax
call fcn.0044c87c
add ebx, eax
jmp 0x44c9e9
push eax
push edi
push 0x470f90
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.00403c23
add esp, 0x14
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x44c9e8
lea ecx, [esp + 0x10]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x44c994
sub ecx, edx
sar ecx, 1
cmp ecx, dword [0x491ec0]
jae 0x44c9e8
mov esi, dword [0x491ebc]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
lea eax, [esp + 0x14]
push eax
push esi
call fcn.00438a9c
add esp, 0xc
xor esi, esi
test eax, eax
je 0x44c9e8
push 4
push esi
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [0x4b9168], 1
inc ebx
lea eax, [esp + 0x218]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x44c8e6
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x44ca15
inc ebx
jmp 0x44ca54
mov ecx, edi
call fcn.0040938c
cmp eax, dword [0x491ec0]
jae 0x44ca54
mov esi, dword [0x491ebc]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push edi
push esi
call fcn.00438a9c
add esp, 0xc
test eax, eax
je 0x44ca54
push 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [0x4b9168], 1
mov eax, ebx
jmp 0x44ca5a
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x45c
ret 0x10
Function at 0x44ca67
Capabilities:
Get file system object information
Query or enumerate registry value

Disassembly:
sub esp, 0x6bc
lea eax, [esp + 0x208]
push ebp
push esi
mov ebp, 0x2b4
push ebp
push 0
push eax
call fcn.0041c9b0
mov esi, dword [esp + 0x6d4]
add esp, 0xc
test esi, esi
je 0x44cbd9
push edi
mov edi, dword [esp + 0x6d0]
test edi, edi
je 0x44cbd8
push ebx
mov ebx, dword [esp + 0x6d8]
test ebx, ebx
je 0x44cbd7
push 0x1000
xor eax, eax
mov word [edi], ax
lea eax, [esp + 0x21c]
or dword [ebx], 0xffffffff
push ebp
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esp + 0x224]
push eax
call ebp
test eax, eax
jle 0x44cb14
push edi
call ebp
dec eax
shr eax, 1
je 0x44cb08
push SysReAllocString
lea ecx, [esp + 0x228]
mov edx, eax
push ecx
push ecx
mov ecx, edi
call fcn.0044c7cd
mov eax, dword [esp + 0x21c]
jmp 0x44cbd5
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x200
push eax
lea eax, [esp + 0x4d0]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
push eax
push closesocket
call esi
push str.DefaultIcon
mov edx, 0x200
lea ecx, [esp + 0x4d0]
call fcn.00415a78
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x104
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x4d4]
push eax
push closesocket
call esi
lea eax, [esp + 0x18]
push 0x46f848
push eax
call fcn.0041bcae
mov dword [esp + 0x1c], eax
pop ecx
pop ecx
test eax, eax
je 0x44cbd7
push eax
call ebp
xor esi, esi
inc esi
sub esi, eax
lea eax, [esp + 0x18]
push eax
call ebp
push edi
add esi, eax
call ebp
shr eax, 1
je 0x44cbc7
shr esi, 1
cmp esi, 0x7ffffffe
jbe 0x44cbb7
xor eax, eax
mov word [edi], ax
jmp 0x44cbc7
push esi
lea ecx, [esp + 0x1c]
mov edx, eax
push ecx
push ecx
mov ecx, edi
call fcn.0044c7cd
mov eax, dword [esp + 0x14]
add eax, 2
push eax
call fcn.0042a425
pop ecx
mov dword [ebx], eax
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x6bc
ret 0xc
Function at 0x44cbe4
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov esi, dword [ebp + 0xc]
push edi
test esi, esi
je 0x44cd1e
cmp dword [ebp + 0x10], 0
je 0x44cd1e
push 0x200
xor edi, edi
lea eax, [ebp - 0x208]
push edi
push eax
call fcn.0041c9b0
add esp, 0xc
mov dword [ebp + 0xc], edi
lea eax, [ebp + 0xc]
push eax
push 0x45f760
push 1
push edi
push 0x45f790
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x44cd1e
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x44cd1e
mov eax, dword [ebp + 0x20]
test eax, eax
jns 0x44cc66
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp - 0x208]
push eax
push esi
call fcn.0044ca67
mov eax, dword [ebp + 0x20]
mov edx, dword [ebp + 0xc]
cmp word [ebp - 0x208], di
mov ecx, dword [edx]
push eax
lea eax, [ebp - 0x208]
cmove eax, dword [ebp + 0x1c]
push eax
push edx
call dword [ecx + 0x44]
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 8]
push edx
push 0x100
mov dword [ebp - 8], edi
lea edx, [ebp - 0x208]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x40]
mov eax, dword [ebp + 0xc]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp + 0xc]
mov esi, 0x4679ec
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp + 0xc]
push dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp + 0xc]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp + 0xc]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 4]
push edx
mov dword [ebp - 4], edi
push 0x45f7a0
mov eax, dword [ecx]
push ecx
call dword [eax]
mov esi, eax
test esi, esi
js 0x44cd0c
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x44cd0c
mov eax, dword [ecx]
push 1
push dword [ebp + 0x10]
push ecx
call dword [eax + 0x18]
mov esi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
not esi
shr esi, 0x1f
mov eax, esi
jmp 0x44cd20
xor eax, eax
pop edi
pop esi
leave
ret 0x1c
Function at 0x44cd26
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
test esi, esi
je 0x44ce97
cmp dword [ebp + 0x10], ebx
je 0x44ce97
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x44ce97
cmp dword [ebp - 4], ebx
je 0x44ce97
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0041c9b0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x44ce89
push edi
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
mov edi, 0x103
push eax
push str._s_s.lnk
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.00403c23
add esp, 0x14
mov dword [ebp + 0x10], ebx
lea eax, [ebp + 0x10]
push eax
push 0x45f760
push 1
push ebx
push 0x45f790
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x44ce88
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x44ce88
lea edx, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
mov eax, dword [ecx]
push edx
push 0x45f7a0
push ecx
call dword [eax]
test eax, eax
js 0x44ce68
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x44ce68
mov eax, dword [ecx]
lea edx, [ebp - 0x414]
push ebx
push edx
push ecx
call dword [eax + 0x14]
test eax, eax
js 0x44ce5f
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x61c]
push edi
push edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x20]
test eax, eax
js 0x44ce5f
lea eax, [ebp - 0x61c]
mov cx, word [esi]
cmp cx, word [eax]
jne 0x44ce55
test cx, cx
je 0x44ce5a
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x44ce55
add esi, 4
add eax, 4
test cx, cx
jne 0x44ce31
jmp 0x44ce5a
sbb ebx, ebx
or ebx, 1
test ebx, ebx
sete bl
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test bl, bl
je 0x44ce88
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb al, al
and bl, al
pop edi
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
movzx eax, bl
jmp 0x44ce99
xor eax, eax
pop esi
pop ebx
leave
ret 0xc
Function at 0x44ce9f
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
push ebp
push esi
xor eax, eax
push 0x208
push eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x14]
push eax
call fcn.0041c9b0
add esp, 0xc
cmp dword [esp + 0x21c], 0
je 0x44cf9b
cmp dword [esp + 0x220], 0
je 0x44cf9b
cmp dword [esp + 0x228], 0
je 0x44cf9b
mov ebp, dword [esp + 0x22c]
test ebp, ebp
je 0x44cf9b
mov esi, dword [esp + 0x230]
test esi, esi
je 0x44cf9b
lea eax, [esp + 8]
push eax
push dword [esp + 0x21c]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x44cf9b
cmp dword [esp + 8], 0
je 0x44cf9b
lea eax, [esp + 0xc]
push eax
push dword [esp + 0xc]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [esp + 8]
test eax, eax
je 0x44cf95
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push dword [esp + 0x224]
lea eax, [esp + 0x10]
push eax
push str._s_s.lnk
lea eax, [ebp - 1]
push eax
push dword [esp + 0x238]
call fcn.00403c23
add esp, 0x14
xor eax, eax
cmp word [esi], ax
cmove esi, dword [esp + 0x220]
push eax
push esi
push ecx
push ecx
push dword [esp + 0x238]
push dword [esp + 0x234]
push dword [esp + 0x234]
call fcn.0044cbe4
jmp 0x44cf9d
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
pop esi
pop ebp
add esp, 0x20c
ret 0x1c

Function at 0x44d032
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
push ebx
push esi
mov esi, 0x208
lea eax, [ebp - 0x428]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.0041c9b0
add esp, 0xc
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x44d163
cmp dword [ebp + 0x10], ebx
je 0x44d163
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x44d163
cmp dword [ebp - 4], ebx
je 0x44d163
lea eax, [ebp - 0x428]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x44d151
push 0x46cfbc
mov edx, esi
lea ecx, [ebp - 0x428]
call fcn.00415a78
push dword [ebp + 0xc]
mov edx, esi
lea ecx, [ebp - 0x428]
call fcn.00415a78
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44d12f
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x21c], 0x4654d8
mov dword [ebp - 0x218], eax
lea ecx, [ebp - 0x21c]
xor eax, eax
mov dword [ebp - 0x214], ebx
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x428]
push eax
mov dword [ebp - 0x210], 0x104
call fcn.00403489
mov ecx, dword [ebp - 0x218]
mov dword [ebp - 0x21c], 0x46cfd4
call fcn.00410c7f
mov bl, al
jmp 0x44d131
mov bl, 1
mov edx, dword [ebp + 0x14]
and edx, 0x7fffffff
je 0x44d151
push SysReAllocString
lea eax, [ebp - 0x428]
push eax
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.0044c7cd
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
test bl, bl
setne al
jmp 0x44d165
xor eax, eax
pop esi
pop ebx
leave
ret 0x10
Function at 0x44d1bc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
lea eax, [ebp - 0x208]
push ebx
mov ebx, 0x208
push ebx
push 0
push eax
call fcn.0041c9b0
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x44d239
mov ecx, dword [ebp + 0xc]
call fcn.0040938c
cmp eax, 1
jb 0x44d239
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x44d239
push 0x46cfbc
mov edx, ebx
lea ecx, [ebp - 0x208]
call fcn.00415a78
push dword [ebp + 0xc]
mov edx, ebx
lea ecx, [ebp - 0x208]
call fcn.00415a78
sub esp, 0xc
lea eax, [ebp - 0x208]
push eax
call fcn.0044c87c
pop ebx
leave
ret 8

Function at 0x44d272
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x44d28a
xor eax, eax
jmp 0x44d321
push SysReAllocString
push esi
push ecx
mov edx, 0x208
lea ecx, [ebp - 0x410]
call fcn.0044c7cd
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + eax*2 - 0x412]
jmp 0x44d2c0
cmp word [eax], 0x5c
je 0x44d2cc
sub eax, 2
lea ecx, [ebp - 0x410]
cmp eax, ecx
ja 0x44d2b7
jmp 0x44d307
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44d307
push 0
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x44d307
lea eax, [ebp - 0x410]
mov ecx, 0x4b9168
push eax
call fcn.0044d272
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44d31e
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x44d321
xor eax, eax
inc eax
pop esi
leave
ret 4