joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448dc3
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x894
push ebx
push ebp
push esi
push edi
push 0x428
lea eax, [esp + 0x47c]
mov ebx, ecx
push 0
push eax
call fcn.0041db90
add esp, 0xc
mov dword [esp + 0x10], 0x4679a8
lea eax, [esp + 0x58]
or esi, 0xffffffff
lea ecx, [esp + 0x48]
mov dword [esp + 0x14], esi
push dword [esp + 0x8ac]
push 0x104
push eax
call fcn.0040331f
mov edi, dword [esp + 0x8a8]
mov dword [esp + 0x48], 0x46cf7c
test edi, edi
je 0x449001
cmp dword [esp + 0x8ac], 0
je 0x449001
lea eax, [esp + 0x24]
xor ebp, ebp
push eax
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x449001
push edi
push 0x104
lea eax, [esp + 0x278]
push eax
lea ecx, [esp + 0x26c]
call fcn.0040331f
mov dword [esp + 0x260], 0x46cf7c
cmp dword [esp + 0x268], ebp
jbe 0x449001
push ecx
push 3
push 1
push SysReAllocStringLen
push dword [esp + 0x274]
lea ecx, [esp + 0x24]
call fcn.00401442
test al, al
je 0x448ffd
lea eax, [esp + 0x478]
push eax
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov esi, dword [esp + 0x14]
xorps xmm0, xmm0
mov eax, dword [esp + 0x24]
mov dword [esp + 0x488], ebp
mov dword [esp + 0x490], eax
mov dword [esp + 0x48c], ebp
movlpd qword [esp + 0x18], xmm0
cmp esi, 0xffffffff
je 0x448eed
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x448ef6
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x50]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x898], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x89c], ecx
test edx, edx
je 0x448f3d
test eax, eax
je 0x448f59
mov ecx, ebp
test edx, edx
je 0x448f3d
cmp word [eax + ecx*2], 0x5c
jne 0x448f38
push 0x2f
pop edx
mov word [eax + ecx*2], dx
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x4c]
inc ecx
cmp ecx, edx
jb 0x448f22
test eax, eax
je 0x448f59
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x49c]
push 0x200
push eax
call fcn.0042a2ba
add esp, 0x10
lea eax, [esp + 0x478]
mov ecx, ebx
push eax
call fcn.004486fd
test al, al
je 0x449001
cmp dword [ebx + 0x2b0], ebp
jne 0x448f93
push 0x45f8cc
push 0x400080
call fcn.0041bcdd
mov dword [ebx + 0x2b0], eax
pop ecx
pop ecx
test eax, eax
je 0x449001
mov ebp, dword [ebx + 0x2b0]
cmp esi, 0xffffffff
je 0x448ff2
test ebp, ebp
je 0x448ff2
xor edi, edi
and dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push 0
push eax
mov eax, 0x400000
sub eax, edi
push eax
lea eax, [edi + ebp]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x448fda
cmp dword [esp + 0x10], 0
je 0x448fda
add edi, dword [esp + 0x10]
cmp edi, 0x400000
jb 0x448fa4
test edi, edi
je 0x448ff2
push edi
push dword [ebx + 0x2b0]
mov ecx, ebx
call fcn.0044863a
test al, al
jne 0x448f93
jmp 0x449001
mov ecx, ebx
call fcn.004482d1
mov bl, al
jmp 0x449003
mov esi, dword [esp + 0x14]
xor bl, bl
and dword [esp + 0x4c], 0
and dword [esp + 0x50], 0
mov dword [esp + 0x48], 0x4654d8
cmp esi, 0xffffffff
je 0x449021
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x894
ret 8
Function at 0x449aad
Capabilities:
Create process on windows
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
lea eax, [ebp - 0x244]
push ebx
push edi
mov ebx, 0x208
xor edi, edi
push ebx
push edi
push eax
call fcn.0041db90
add esp, 0xc
lea eax, [ebp - 0x244]
push eax
push edi
push edi
push 0x26
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [ebp - 0x244]
call fcn.0040f732
test al, al
jne 0x449b64
call fcn.004097f4
test al, al
je 0x449b64
call fcn.00409797
test al, al
jne 0x449b64
push 0x3c
lea eax, [ebp - 0x3c]
push edi
push eax
call fcn.0041db90
push ebx
lea eax, [ebp - 0x44c]
push edi
push eax
call fcn.0041db90
add esp, 0x18
mov dword [ebp - 0x3c], 0x3c
lea eax, [ebp - 0x44c]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0x4679ec
push 0x103
push eax
push edi
mov dword [ebp - 0x30], 0x471228
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
neg eax
sbb al, al
inc al
jmp 0x449b66
mov al, 1
pop edi
pop ebx
leave
ret
Function at 0x44b59f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, ecx
call fcn.0044b565
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [esi + 0x118], eax
cmp eax, 0x390
jae 0x44b5cd
and dword [esi + 0x118], 0
xor al, al
jmp 0x44b60d
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [esi + 0x110], eax
test eax, eax
je 0x44b5c2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esi + 0x114], eax
test eax, eax
jne 0x44b60b
push dword [esi + 0x110]
call dword [sym.imp.KERNEL32.dll_FreeResource]
and dword [esi + 0x110], 0
jmp 0x44b5c2
mov al, 1
pop esi
ret 8

Function at 0x44c6f3
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Import public key
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 0
push esi
push edi
mov esi, ecx
je 0x44c762
cmp dword [ebp + 0xc], 0
je 0x44c762
cmp dword [ebp + 0x10], 0
je 0x44c762
cmp dword [ebp + 0x14], 0
je 0x44c762
mov eax, dword [esi]
test eax, eax
je 0x44c762
xor edi, edi
cmp dword [eax + 0xc], edi
je 0x44c762
push 0xf0000000
push 1
push edi
push edi
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x44c762
lea eax, [ebp - 8]
push eax
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
add eax, 0x38
push eax
push 0x10001
push dword [ebp - 4]
call dword [sym.imp.CRYPT32.dll_CryptImportPublicKeyInfo]
test eax, eax
jne 0x44c76a
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
pop edi
pop esi
leave
ret 0x10
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push 0x8004
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x44c78d
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x44c758
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x44c7b5
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x44c758
push edi
push edi
push dword [ebp - 8]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptVerifySignatureW]
push dword [ebp - 8]
test eax, eax
je 0x44c7a4
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, 1
jmp 0x44c764
Function at 0x44d3b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, ecx
push ebx
push esi
test edx, edx
je 0x44d401
cmp dword [ebp + 0xc], 0
xorps xmm0, xmm0
movlpd qword [ebp - 8], xmm0
jb 0x44d401
ja 0x44d3d3
cmp dword [ebp + 8], 0
jbe 0x44d401
mov esi, dword [ebp - 4]
xor bl, bl
mov ecx, dword [ebp - 8]
mov eax, ecx
and eax, 0xf
mov al, byte [eax*4 + 0x4698c0]
add al, bl
xor byte [ecx + edx], al
mov bl, byte [ecx + edx]
add ecx, 1
adc esi, 0
cmp esi, dword [ebp + 0xc]
jb 0x44d3db
ja 0x44d401
cmp ecx, dword [ebp + 8]
jb 0x44d3db
pop esi
pop ebx
leave
ret

Function at 0x44d455
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x44d48b
test esi, esi
je 0x44d496
xor edx, edx
test edi, edi
je 0x44d496
mov ch, dl
mov cl, byte [edx + esi]
mov eax, edx
and eax, 0xf
mov al, byte [eax + ebx]
add al, ch
mov ch, cl
xor al, cl
mov byte [edx + esi], al
inc edx
cmp edx, edi
jb 0x44d470
jmp 0x44d496
push 0x4698c0
call fcn.0044d58f
pop ecx
pop edi
pop esi
pop ebx
ret

Function at 0x44d49a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x44d4db
cmp dword [ebp + 0xc], 0
je 0x44d4db
test esi, esi
je 0x44d4e6
xor ecx, ecx
test edi, edi
je 0x44d4e6
mov byte [ebp + 0xb], cl
xor edx, edx
mov eax, ecx
div dword [ebp + 0xc]
mov al, byte [edx + ebx]
add al, byte [ebp + 0xb]
xor byte [ecx + esi], al
mov al, byte [ecx + esi]
inc ecx
mov byte [ebp + 0xb], al
cmp ecx, edi
jb 0x44d4be
jmp 0x44d4e6
push 0x4698c0
call fcn.0044d561
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x44d53a
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov byte [ecx + 0x68], al
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x44d561
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x44d58d
xor ecx, ecx
test edx, edx
je 0x44d58d
push ebx
push edi
mov edi, dword [esp + 0x10]
mov bl, cl
mov eax, ecx
and eax, 0xf
mov al, byte [edi + eax*4]
add al, bl
xor byte [ecx + esi], al
mov bl, byte [ecx + esi]
inc ecx
cmp ecx, edx
jb 0x44d576
pop edi
pop ebx
pop esi
ret

Function at 0x44d58f
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x44d5c3
xor edx, edx
test edi, edi
je 0x44d5c3
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov bl, dl
mov cl, byte [edx + esi]
mov eax, edx
and eax, 0xf
mov al, byte [ebp + eax*4]
add al, bl
mov bl, cl
xor al, cl
mov byte [edx + esi], al
inc edx
cmp edx, edi
jb 0x44d5a7
pop ebp
pop ebx
pop edi
pop esi
ret
Function at 0x44d860
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
sub esp, 0x45c
lea eax, [esp]
push ebx
push ebp
push esi
push edi
xor esi, esi
push 0x208
push esi
push eax
mov ebx, esi
call fcn.0041db90
mov edi, dword [esp + 0x47c]
add esp, 0xc
test edi, edi
je 0x44da3c
push 0x470fe8
push edi
push 0x470ff8
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.00403ccb
add esp, 0x14
lea eax, [esp + 0x218]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x44d9eb
test byte [esp + 0x218], 0x10
lea eax, [esp + 0x244]
je 0x44d949
push 0x46fe84
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x44d9cd
push 0x470ff0
lea eax, [esp + 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x44d9cd
lea eax, [esp + 0x244]
push eax
push edi
push 0x470ff8
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.00403ccb
add esp, 0x14
lea eax, [esp + 0x10]
mov ecx, 0x4b9588
push 1
push 1
push 0x470fe8
push eax
call fcn.0044d860
add ebx, eax
jmp 0x44d9cd
push eax
push edi
push 0x470ff8
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.00403ccb
add esp, 0x14
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x44d9cc
lea ecx, [esp + 0x10]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x44d978
sub ecx, edx
sar ecx, 1
cmp ecx, dword [0x491ec0]
jae 0x44d9cc
mov esi, dword [0x491ebc]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
lea eax, [esp + 0x14]
push eax
push esi
call fcn.00439c7c
add esp, 0xc
xor esi, esi
test eax, eax
je 0x44d9cc
push 4
push esi
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [0x4b9588], 1
inc ebx
lea eax, [esp + 0x218]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x44d8ca
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x44d9f9
inc ebx
jmp 0x44da38
mov ecx, edi
call fcn.00409665
cmp eax, dword [0x491ec0]
jae 0x44da38
mov esi, dword [0x491ebc]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push edi
push esi
call fcn.00439c7c
add esp, 0xc
test eax, eax
je 0x44da38
push 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [0x4b9588], 1
mov eax, ebx
jmp 0x44da3e
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x45c
ret 0x10
Function at 0x44da4b
Capabilities:
Get file system object information
Query or enumerate registry value

Disassembly:
sub esp, 0x6bc
lea eax, [esp + 0x208]
push ebp
push esi
mov ebp, 0x2b4
push ebp
push 0
push eax
call fcn.0041db90
mov esi, dword [esp + 0x6d4]
add esp, 0xc
test esi, esi
je 0x44dbbd
push edi
mov edi, dword [esp + 0x6d0]
test edi, edi
je 0x44dbbc
push ebx
mov ebx, dword [esp + 0x6d8]
test ebx, ebx
je 0x44dbbb
push 0x1000
xor eax, eax
mov word [edi], ax
lea eax, [esp + 0x21c]
or dword [ebx], 0xffffffff
push ebp
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esp + 0x224]
push eax
call ebp
test eax, eax
jle 0x44daf8
push edi
call ebp
dec eax
shr eax, 1
je 0x44daec
push SysReAllocString
lea ecx, [esp + 0x228]
mov edx, eax
push ecx
push ecx
mov ecx, edi
call fcn.0044d7b1
mov eax, dword [esp + 0x21c]
jmp 0x44dbb9
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x200
push eax
lea eax, [esp + 0x4d0]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
push eax
push SysReAllocStringLen
call esi
push str.DefaultIcon
mov edx, 0x200
lea ecx, [esp + 0x4d0]
call fcn.00415db6
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x104
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x4d4]
push eax
push SysReAllocStringLen
call esi
lea eax, [esp + 0x18]
push 0x46f928
push eax
call fcn.0041ce8e
mov dword [esp + 0x1c], eax
pop ecx
pop ecx
test eax, eax
je 0x44dbbb
push eax
call ebp
xor esi, esi
inc esi
sub esi, eax
lea eax, [esp + 0x18]
push eax
call ebp
push edi
add esi, eax
call ebp
shr eax, 1
je 0x44dbab
shr esi, 1
cmp esi, 0x7ffffffe
jbe 0x44db9b
xor eax, eax
mov word [edi], ax
jmp 0x44dbab
push esi
lea ecx, [esp + 0x1c]
mov edx, eax
push ecx
push ecx
mov ecx, edi
call fcn.0044d7b1
mov eax, dword [esp + 0x14]
add eax, 2
push eax
call fcn.0042b605
pop ecx
mov dword [ebx], eax
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x6bc
ret 0xc
Function at 0x44dbc8
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov esi, dword [ebp + 0xc]
push edi
test esi, esi
je 0x44dd02
cmp dword [ebp + 0x10], 0
je 0x44dd02
push 0x200
xor edi, edi
lea eax, [ebp - 0x208]
push edi
push eax
call fcn.0041db90
add esp, 0xc
mov dword [ebp + 0xc], edi
lea eax, [ebp + 0xc]
push eax
push 0x45f760
push 1
push edi
push 0x45f790
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x44dd02
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x44dd02
mov eax, dword [ebp + 0x20]
test eax, eax
jns 0x44dc4a
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp - 0x208]
push eax
push esi
call fcn.0044da4b
mov eax, dword [ebp + 0x20]
mov edx, dword [ebp + 0xc]
cmp word [ebp - 0x208], di
mov ecx, dword [edx]
push eax
lea eax, [ebp - 0x208]
cmove eax, dword [ebp + 0x1c]
push eax
push edx
call dword [ecx + 0x44]
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 8]
push edx
push 0x100
mov dword [ebp - 8], edi
lea edx, [ebp - 0x208]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x40]
mov eax, dword [ebp + 0xc]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp + 0xc]
mov esi, 0x4679ec
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp + 0xc]
push dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp + 0xc]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp + 0xc]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 4]
push edx
mov dword [ebp - 4], edi
push 0x45f7a0
mov eax, dword [ecx]
push ecx
call dword [eax]
mov esi, eax
test esi, esi
js 0x44dcf0
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x44dcf0
mov eax, dword [ecx]
push 1
push dword [ebp + 0x10]
push ecx
call dword [eax + 0x18]
mov esi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
not esi
shr esi, 0x1f
mov eax, esi
jmp 0x44dd04
xor eax, eax
pop edi
pop esi
leave
ret 0x1c
Function at 0x44dd0a
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
test esi, esi
je 0x44de7b
cmp dword [ebp + 0x10], ebx
je 0x44de7b
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x44de7b
cmp dword [ebp - 4], ebx
je 0x44de7b
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0041db90
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x44de6d
push edi
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
mov edi, 0x103
push eax
push str._s_s.lnk
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.00403ccb
add esp, 0x14
mov dword [ebp + 0x10], ebx
lea eax, [ebp + 0x10]
push eax
push 0x45f760
push 1
push ebx
push 0x45f790
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x44de6c
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x44de6c
lea edx, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
mov eax, dword [ecx]
push edx
push 0x45f7a0
push ecx
call dword [eax]
test eax, eax
js 0x44de4c
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x44de4c
mov eax, dword [ecx]
lea edx, [ebp - 0x414]
push ebx
push edx
push ecx
call dword [eax + 0x14]
test eax, eax
js 0x44de43
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x61c]
push edi
push edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x20]
test eax, eax
js 0x44de43
lea eax, [ebp - 0x61c]
mov cx, word [esi]
cmp cx, word [eax]
jne 0x44de39
test cx, cx
je 0x44de3e
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x44de39
add esi, 4
add eax, 4
test cx, cx
jne 0x44de15
jmp 0x44de3e
sbb ebx, ebx
or ebx, 1
test ebx, ebx
sete bl
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test bl, bl
je 0x44de6c
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb al, al
and bl, al
pop edi
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
movzx eax, bl
jmp 0x44de7d
xor eax, eax
pop esi
pop ebx
leave
ret 0xc
Function at 0x44de83
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
push ebp
push esi
xor eax, eax
push 0x208
push eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x14]
push eax
call fcn.0041db90
add esp, 0xc
cmp dword [esp + 0x21c], 0
je 0x44df7f
cmp dword [esp + 0x220], 0
je 0x44df7f
cmp dword [esp + 0x228], 0
je 0x44df7f
mov ebp, dword [esp + 0x22c]
test ebp, ebp
je 0x44df7f
mov esi, dword [esp + 0x230]
test esi, esi
je 0x44df7f
lea eax, [esp + 8]
push eax
push dword [esp + 0x21c]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x44df7f
cmp dword [esp + 8], 0
je 0x44df7f
lea eax, [esp + 0xc]
push eax
push dword [esp + 0xc]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [esp + 8]
test eax, eax
je 0x44df79
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push dword [esp + 0x224]
lea eax, [esp + 0x10]
push eax
push str._s_s.lnk
lea eax, [ebp - 1]
push eax
push dword [esp + 0x238]
call fcn.00403ccb
add esp, 0x14
xor eax, eax
cmp word [esi], ax
cmove esi, dword [esp + 0x220]
push eax
push esi
push ecx
push ecx
push dword [esp + 0x238]
push dword [esp + 0x234]
push dword [esp + 0x234]
call fcn.0044dbc8
jmp 0x44df81
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
pop esi
pop ebp
add esp, 0x20c
ret 0x1c

Function at 0x44e016
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
push ebx
push esi
mov esi, 0x208
lea eax, [ebp - 0x428]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.0041db90
add esp, 0xc
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x44e147
cmp dword [ebp + 0x10], ebx
je 0x44e147
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x44e147
cmp dword [ebp - 4], ebx
je 0x44e147
lea eax, [ebp - 0x428]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x44e135
push 0x46cf64
mov edx, esi
lea ecx, [ebp - 0x428]
call fcn.00415db6
push dword [ebp + 0xc]
mov edx, esi
lea ecx, [ebp - 0x428]
call fcn.00415db6
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44e113
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x21c], 0x4654d8
mov dword [ebp - 0x218], eax
lea ecx, [ebp - 0x21c]
xor eax, eax
mov dword [ebp - 0x214], ebx
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x428]
push eax
mov dword [ebp - 0x210], 0x104
call fcn.00403488
mov ecx, dword [ebp - 0x218]
mov dword [ebp - 0x21c], 0x46cf7c
call fcn.00411004
mov bl, al
jmp 0x44e115
mov bl, 1
mov edx, dword [ebp + 0x14]
and edx, 0x7fffffff
je 0x44e135
push SysReAllocString
lea eax, [ebp - 0x428]
push eax
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.0044d7b1
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
test bl, bl
setne al
jmp 0x44e149
xor eax, eax
pop esi
pop ebx
leave
ret 0x10
Function at 0x44e1a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
lea eax, [ebp - 0x208]
push ebx
mov ebx, 0x208
push ebx
push 0
push eax
call fcn.0041db90
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x44e21d
mov ecx, dword [ebp + 0xc]
call fcn.00409665
cmp eax, 1
jb 0x44e21d
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x44e21d
push 0x46cf64
mov edx, ebx
lea ecx, [ebp - 0x208]
call fcn.00415db6
push dword [ebp + 0xc]
mov edx, ebx
lea ecx, [ebp - 0x208]
call fcn.00415db6
sub esp, 0xc
lea eax, [ebp - 0x208]
push eax
call fcn.0044d860
pop ebx
leave
ret 8

Function at 0x44e256
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x44e26e
xor eax, eax
jmp 0x44e305
push SysReAllocString
push esi
push ecx
mov edx, 0x208
lea ecx, [ebp - 0x410]
call fcn.0044d7b1
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + eax*2 - 0x412]
jmp 0x44e2a4
cmp word [eax], 0x5c
je 0x44e2b0
sub eax, 2
lea ecx, [ebp - 0x410]
cmp eax, ecx
ja 0x44e29b
jmp 0x44e2eb
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44e2eb
push 0
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x44e2eb
lea eax, [ebp - 0x410]
mov ecx, 0x4b9588
push eax
call fcn.0044e256
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44e302
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x44e305
xor eax, eax
inc eax
pop esi
leave
ret 4