joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47eefa
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x2e
mov esi, ebx
mov edi, eax
call fcn.00443314
test eax, eax
jg 0x47ef1c
mov al, 1
jmp 0x47f059
lea ecx, [ebp - 8]
push ecx
push ebx
mov ecx, eax
call fcn.00438242
lea eax, [ebp - 0x14]
push eax
call fcn.004441b6
push dword [ebp - 8]
mov eax, dword [ebp + 0xc]
push dword [ebx]
push dword [eax]
lea eax, [ebp - 0x14]
push str.__verbose___log_file__s____remove_pack_file___s____s_
push eax
call fcn.004492b5
add esp, 0x14
cmp dword [edi + 0x10], 0
je 0x47ef5b
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
push 0
push 0x8000008
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [edi + 0xc]
push eax
call fcn.0046e2a4
add esp, 0x14
lea esi, [ebp - 8]
mov byte [ebp - 1], 1
call fcn.0045d4c0
test al, al
je 0x47ef93
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x47f02a
lea eax, [ebp - 0x10]
push eax
call fcn.004441b6
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.0046e94a
pop ecx
lea eax, [ebp - 0xc]
push eax
call fcn.004441b6
push 0xca
lea esi, [ebp - 0x18]
call fcn.0047dae7
mov eax, dword [ebp - 8]
mov ebx, dword [eax - 0xc]
mov eax, dword [ebp - 0x18]
pop ecx
push 0x5c
lea esi, [ebp - 8]
mov dword [ebp - 0x1c], eax
call fcn.00443314
mov ecx, ebx
sub ecx, eax
lea eax, [ebp - 0x20]
push eax
mov eax, esi
push eax
call fcn.004381e6
push dword [ebp - 0x10]
push dword [eax]
lea eax, [ebp - 0xc]
push dword [ebp - 0x1c]
push eax
call fcn.004492b5
add esp, 0x10
lea ecx, [ebp - 0x20]
call fcn.00402907
push 0
lea esi, [ebp - 0xc]
call fcn.004749b7
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 1], 0
call fcn.00402907
mov ecx, esi
call fcn.00402907
lea ecx, [ebp - 0x10]
call fcn.00402907
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [edi + 0x10], 0
je 0x47f046
mov edi, dword [edi + 0x10]
mov eax, dword [edi]
push ebx
mov ecx, edi
call dword [eax + 0x18]
lea ecx, [ebp - 0x14]
call fcn.00402907
lea ecx, [ebp - 8]
call fcn.00402907
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x47f19e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov dword [ebx + 0x10], eax
cmp dword [eax], edi
je 0x47f1d5
push edi
push edi
push edi
push edi
lea esi, [ebx + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, eax
call fcn.004185f7
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
push dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x10]
xor edi, edi
lea eax, [ebp - 4]
push eax
push edi
push ebx
push 0x47f3f9
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x18], esi
cmp dword [eax], edi
je 0x47f22b
mov edi, ebx
call fcn.0047f269
mov ebx, dword [ebx + 4]
mov esi, eax
mov eax, dword [edi]
mov dword [ebp - 0xc], edx
call fcn.0046b47e
add esi, eax
adc dword [ebp - 0xc], edx
mov eax, dword [edi + 0x10]
push dword [ebp - 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
push esi
call dword [eax]
mov eax, dword [edi + 0x10]
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 8]
mov esi, dword [ebp - 0x18]
xor edi, edi
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x47f255
mov ebx, dword [ebp - 4]
cmp esi, edi
je 0x47f251
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x47f262
cmp esi, edi
je 0x47f260
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x47f757
Capabilities:
Get geographical location

Disassembly:
push ebp
push esi
push edi
push 0
push 0x4f2bb8
movzx ebx, bx
push 0x1001
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ebp, eax
mov ecx, 0x521fcc
lea edi, [ebp - 1]
call fcn.0040292a
test edi, edi
jle 0x47f7a0
push edi
call fcn.004443c2
push edi
push 0x78
push eax
call fcn.004af810
add esp, 0xc
mov eax, edi
mov edx, esi
call fcn.004443e8
mov eax, dword [esi]
sub eax, 0x10
cmp dword [eax + 0xc], 1
jle 0x47f7b4
push dword [eax + 4]
push esi
call fcn.004444e9
mov eax, dword [esi]
push ebp
push eax
push 0x1001
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
pop edi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x47f894
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push edi
push 0x3c
xor edi, edi
lea eax, [ebp - 0x3c]
push edi
push eax
call fcn.004af810
mov eax, dword [ebp + 8]
mov eax, dword [eax]
add esp, 0xc
lea ecx, [ebp - 0x3c]
push ecx
push edi
push edi
push eax
mov dword [ebp - 0x28], 0x64
mov dword [ebp - 0x3c], 0x3c
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x47f8d8
push ebx
call fcn.004441b6
jmp 0x47f8e5
push dword [ebp - 0x2c]
mov edi, dword [ebp - 0x28]
mov eax, ebx
call fcn.0046ee75
mov eax, ebx
pop edi
leave
ret
Function at 0x47fcb4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
lea esi, [edi + 4]
push dword [esi]
call fcn.0047f7ca
pop ecx
push esi
call fcn.00416ec5
mov eax, dword [edi + 0x28]
push dword [eax]
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [esi]
call ebx
lea eax, [ebp - 4]
push eax
call fcn.004441b6
push 0xdc
lea eax, [ebp - 4]
push eax
call fcn.004045bd
push 0x40a
push dword [esi]
call dword [sym.imp.USER32.dll_GetDlgItem]
push dword [ebp - 4]
push eax
call ebx
lea eax, [edi + 0x40]
push eax
mov eax, dword [esi]
call fcn.00481d86
push dword [esi]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
push edi
push 0x47fd83
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [ebp - 4]
mov dword [edi + 0x30], eax
call fcn.00402907
pop esi
xor eax, eax
pop ebx
leave
ret

Function at 0x47fec8
Capabilities:
Get session user name
List groups for user account

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x51f714]
xor eax, ebp
mov dword [ebp + 0x198], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x6c]
xor ebx, ebx
push eax
mov dword [ebp - 0x78], ebx
call esi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x6c]
push eax
call esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.004046e4
lea eax, [ebp - 0x70]
push eax
mov ecx, str.SYSTEM
call fcn.0045e470
test eax, eax
jne 0x47ff2f
lea ecx, [ebp - 0x70]
call fcn.00402907
mov al, 1
jmp 0x47ff88
push edi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x7c]
push eax
push 1
push ebx
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], ebx
push ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x80], ebx
call sub.NETAPI32.dll_NetUserGetLocalGroups
test eax, eax
jne 0x47ff7d
mov esi, dword [ebp - 0x7c]
xor edi, edi
cmp dword [ebp - 0x74], ebx
jbe 0x47ff7d
cmp esi, ebx
je 0x47ff70
mov ecx, dword [esi]
call fcn.0045b910
test eax, eax
je 0x47ff7b
add esi, 4
inc edi
cmp edi, dword [ebp - 0x74]
jb 0x47ff61
jmp 0x47ff7d
mov bl, 1
lea ecx, [ebp - 0x70]
call fcn.00402907
mov al, bl
pop edi
mov ecx, dword [ebp + 0x198]
pop esi
xor ecx, ebp
pop ebx
call fcn.004ad67b
add ebp, 0x19c
leave
ret

Function at 0x4801a1
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [eax]
sub esp, 0x1c
push SysReAllocStringLen
push eax
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
jne 0x4801c2
xor al, al
jmp 0x4801df
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4801be
cmp dword [ebp - 0x18], 4
je 0x4801dd
cmp dword [ebp - 0x18], 2
jne 0x4801be
mov al, 1
leave
ret 4
Function at 0x480e60
Capabilities:
Create process on windows
Query service status
Start service

Disassembly:
push ebp
lea ebp, [esp - 0x304]
sub esp, 0x384
mov eax, dword [0x51f714]
xor eax, ebp
mov dword [ebp + 0x300], eax
push esi
push edi
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0xc], 1
jne 0x480f2b
push 0x4fb898
push str.SAGEWINDOWCLASS
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x480eb3
xor eax, eax
jmp 0x480f8e
push 0x44
pop esi
push esi
xor edi, edi
lea eax, [ebp - 0x80]
push edi
push eax
call fcn.004af810
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0xf8]
push eax
push 0x104
push edi
push str.mstask.exe
push edi
mov dword [ebp - 0x80], esi
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x480ef5
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x480f8e
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x80]
push eax
push edi
push edi
push 0x210
push edi
push edi
push edi
push edi
lea eax, [ebp + 0xf8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x480eea
push dword [ebp - 0x30]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x2c]
call esi
jmp 0x480eac
push 1
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
cmp esi, edi
je 0x480eea
push ebx
push 0x14
push str.Schedule
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
call esi
cmp ebx, edi
je 0x480f80
lea eax, [ebp - 0x3c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x480f7d
cmp dword [ebp - 0x38], 4
je 0x480f88
push edi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x480f88
push ebx
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x480f8d
push ebx
call esi
xor eax, eax
pop ebx
mov ecx, dword [ebp + 0x300]
pop edi
xor ecx, ebp
pop esi
call fcn.004ad67b
add ebp, 0x304
leave
ret
Function at 0x481546
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, eax
test edi, edi
je 0x48155a
add edi, 0xffffffc0
jmp 0x48155c
xor edi, edi
push dword [ebp + 8]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push dword [edi + 4]
mov dword [ebp - 0xc], 1
call ebx
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
or dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], eax
push eax
mov eax, dword [ebp + 0xc]
call fcn.00425bf4
test eax, eax
je 0x4815a9
mov ecx, dword [ebp - 4]
inc ecx
push ecx
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
or eax, 0xffffffff
call fcn.004028ba
mov eax, dword [ebp - 4]
cmp dword [ebp - 8], eax
jge 0x4815da
and dword [ebp - 0xc], 0
push 0xffffffffffffffff
add edi, 0x40
call dword [sym.imp.USER32.dll_MessageBeep]
test edi, edi
je 0x4815c9
lea eax, [edi - 0x40]
jmp 0x4815cb
xor eax, eax
push dword [ebp + 8]
push dword [eax + 4]
call ebx
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x481a5e
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push esi
call fcn.0046ea36
test eax, eax
je 0x481afb
lea eax, [esp + 8]
push eax
xor esi, esi
push 0x28
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x481aab
cmp dword [esp + 8], esi
je 0x481aa7
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x481b12
lea eax, [esp + 0x14]
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push esi
push esi
push esi
lea eax, [esp + 0x1c]
push eax
push esi
push dword [esp + 0x1c]
mov dword [esp + 0x28], 1
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x481a97
cmp dword [esp + 8], esi
je 0x481b00
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x481b00
call fcn.00481b17
push 0x80040002
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
setne al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x481b17
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x51f714]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
push str.CreateToolhelp32Snapshot
push ebx
call esi
test eax, eax
je 0x481c55
push 0
push 2
call eax
mov dword [ebp - 0x248], eax
cmp eax, 0xffffffff
jne 0x481b6d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x481c55
push str._WindowsFolder_explorer.exe
lea eax, [ebp - 0x23c]
push eax
call fcn.004046e4
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x23c]
call fcn.004740de
pop ecx
lea ecx, [ebp - 0x23c]
call fcn.00402907
push str.Process32FirstW
push ebx
call esi
push str.Process32NextW
push ebx
mov edi, eax
call esi
push 0x228
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x234]
push 0
push eax
call fcn.004af810
add esp, 0xc
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x248]
mov dword [ebp - 0x238], 0x22c
call edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x481c35
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x214]
call fcn.0045e470
test eax, eax
jne 0x481c22
push dword [ebp - 0x230]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test esi, esi
je 0x481c22
push esi
call edi
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x248]
call dword [ebp - 0x23c]
test eax, eax
jne 0x481beb
lea ecx, [ebp - 0x240]
call fcn.00402907
cmp dword [ebp - 0x248], 0
je 0x481c55
push dword [ebp - 0x248]
call edi
test ebx, ebx
je 0x481c60
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ad67b
leave
ret

Function at 0x48361b
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push 0x3f7
push dword [esi + 4]
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call ebx
push 0x3eb
push dword [esi + 4]
call edi
push 0
push eax
mov dword [ebp - 4], eax
call ebx
push 0x3ec
push dword [esi + 4]
call edi
xor edi, edi
push edi
push eax
call ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x14]
push eax
sub esi, 0xffffff80
push dword [esi]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call ebx
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
call ebx
mov eax, dword [ebp - 0x18]
push 0x222
push edi
mov dword [ebp - 8], eax
push esi
lea eax, [ebp - 0x14]
call fcn.004024b8
pop edi
pop esi
pop ebx
leave
ret
Function at 0x485c83
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
push eax
call fcn.004441b6
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x80]
mov ecx, dword [eax + 0xc]
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebx + 0x10]
add ecx, 4
call fcn.0046a41f
add eax, 0x24
push eax
lea eax, [ebp - 8]
push eax
call fcn.00425ecf
mov eax, dword [ebp - 8]
cmp dword [eax - 0xc], 0
je 0x485dcd
push dword [edi + 0x84]
lea eax, [ebp - 4]
push eax
call fcn.00425ecf
lea eax, [ebp - 4]
call fcn.0045c2d0
mov eax, dword [ebx + 0x14]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 4]
call fcn.004434e9
lea eax, [ebp - 4]
call fcn.0045c2d0
lea eax, [ebp - 0x10]
push eax
call fcn.0047f909
mov eax, dword [eax]
pop ecx
push dword [eax - 0xc]
push eax
lea eax, [ebp - 4]
call fcn.004434e9
lea ecx, [ebp - 0x10]
call fcn.00402907
xor bl, bl
mov esi, edi
call fcn.00485e7c
push 0x8a
lea esi, [ebp - 0xc]
call fcn.0047dae7
pop ecx
push dword [ebp - 0xc]
push 2
push dword [edi + 0xf4]
push dword [ebp + 0xc]
call fcn.00432ae9
mov ecx, dword [ebp - 4]
push 0
push dword [ebp - 8]
call fcn.0047e16d
mov bl, al
pop ecx
pop ecx
test bl, bl
jne 0x485db9
cmp byte [0x523354], al
je 0x485d85
push str.MD5_of_downloaded_file_is_invalid.
lea eax, [ebp - 0x10]
push eax
call fcn.00474809
push eax
call fcn.00474819
push eax
mov eax, 0x523324
call fcn.00473bef
lea ecx, [ebp - 0x10]
call fcn.00402907
lea esi, [ebp - 4]
call fcn.00411f01
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x5c
call fcn.00443314
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
push ecx
mov ecx, eax
call fcn.00438242
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [ebp - 0x10]
call fcn.00402907
lea ecx, [ebp - 0xc]
call fcn.00402907
lea ecx, [ebp - 4]
call fcn.00402907
test bl, bl
je 0x485df6
push dword [edi + 0xf4]
push dword [ebp + 0xc]
call fcn.0043340d
mov ecx, dword [edi + 0x80]
mov ecx, dword [ecx + 0xc]
add ecx, 4
call fcn.0046a41f
mov byte [eax + 0x68], 1
mov byte [ebp + 0xf], 1
jmp 0x485e50
inc dword [edi + 0x18c]
lea eax, [ebp - 4]
push eax
call fcn.004441b6
push 0x8b
lea esi, [ebp - 0x10]
call fcn.0047dae7
pop ecx
lea edi, [ebp - 4]
call fcn.004432a9
mov ecx, esi
call fcn.00402907
push dword [ebp - 4]
mov eax, dword [ebp + 8]
push 2
push dword [eax + 0xf4]
push dword [ebp + 0xc]
call fcn.00432ae9
mov eax, dword [ebp + 0x10]
mov ecx, edi
mov dword [eax + 0xc], 1
mov byte [ebp + 0xf], 0
call fcn.00402907
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 8]
cmp dword [eax - 0xc], 0
je 0x485e62
mov bl, 1
mov esi, edi
call fcn.00485e7c
lea ecx, [ebp - 8]
call fcn.00402907
lea ecx, [ebp - 0x14]
call fcn.00402907
mov al, byte [ebp + 0xf]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x487ad8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebx + 0x74]
push edi
call fcn.004793d3
mov eax, dword [ebx + 0x74]
xor esi, esi
push esi
push 0x3025
call fcn.0047946c
mov eax, dword [ebx + 0x74]
push esi
push 0x3023
call fcn.0047946c
mov eax, dword [ebx + 0x74]
push esi
push 0x3024
call fcn.0047946c
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x401
push dword [ebx + 4]
call edi
push 1
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0x7f04
push ebx
call fcn.00487e79
push ebx
call fcn.00487bf2
mov dword [ebx + 0x88], esi
push 0
lea esi, [ebx + 0x80]
push dword [esi]
call fcn.0047842f
test eax, eax
jne 0x487bbc
mov esi, dword [esi]
add esi, 0x48
lea eax, [ebx + 0x7c]
mov byte [esi + 0x19], 0
mov byte [esi + 0x18], 0
mov dword [esi + 0x10], eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [esi + 0x1c], eax
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push esi
push 0x48174c
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xae
lea esi, [ebp - 4]
call fcn.0047dae7
pop ecx
mov edi, eax
call fcn.0048820a
mov ecx, esi
mov dword [ebx + 0x94], eax
call fcn.00402907
push 0
push 0x3e8
push 1
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x487bec
mov eax, dword [ebx + 0x74]
mov esi, dword [sym.imp.USER32.dll_GetParent]
mov byte [eax + 0x8d], 1
push dword [ebx + 4]
call esi
push 2
push eax
call edi
push dword [ebx + 4]
mov edi, eax
call esi
push edi
push 2
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
xor eax, eax
pop esi
leave
ret

Function at 0x4888cc
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x51f714]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
push ebx
push edi
mov edi, ecx
jne 0x48890a
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x210]
push eax
push esi
call fcn.004046c1
lea eax, [ebp - 0x214]
push eax
call fcn.004441b6
mov eax, edi
lea edi, [ebp - 0x214]
call fcn.004432a9
lea eax, [ebp - 0x218]
push eax
xor ecx, ecx
push esi
inc ecx
call fcn.004381e6
mov edi, 0x4f2254
push edi
push eax
call fcn.00438350
test eax, eax
lea ecx, [ebp - 0x218]
setne bl
call fcn.00402907
test bl, bl
je 0x48895a
push edi
push esi
call fcn.00443470
push str.AI_WSP_
push esi
call fcn.00443470
mov eax, dword [ebp - 0x214]
push dword [eax - 0xc]
push eax
mov eax, esi
call fcn.004434e9
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x214]
call fcn.00402907
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004ad67b
leave
ret
Function at 0x488cc2
Capabilities:
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xd4
mov eax, dword [0x51f714]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x488cee
push edi
call fcn.004441b6
jmp 0x488d63
mov esi, dword [esi]
push 0x4fbe6c
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.004b3311
add esp, 0xc
test eax, eax
jne 0x488ce6
lea eax, [ebp - 0x58]
push eax
call fcn.004441b6
jmp 0x488d33
push dword [ebp - 0x5c]
lea eax, [ebp - 0x54]
push 0x64
push eax
call fcn.004b3398
add esp, 0xc
test eax, eax
je 0x488d40
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00443470
push dword [ebp - 0x5c]
call fcn.004b3364
pop ecx
test eax, eax
je 0x488d11
push ebx
push dword [ebp - 0x5c]
call fcn.004b34d0
pop ecx
lea ebx, [ebp - 0x58]
call fcn.004606a0
mov eax, ebx
push eax
push edi
call fcn.00425ecf
mov ecx, ebx
call fcn.00402907
pop ebx
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
mov eax, edi
pop esi
call fcn.004ad67b
add ebp, 0x78
leave
ret

Function at 0x488d75
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, eax
lea eax, [ebp - 4]
push eax
call fcn.004441b6
mov ecx, dword [ebp + 0xc]
lea esi, [ebp - 4]
call fcn.004888cc
mov eax, dword [ebp - 4]
cmp dword [eax - 0xc], 0
jne 0x488da7
push dword [ebp + 8]
call fcn.004441b6
jmp 0x488e22
lea ebx, [ebp - 8]
call fcn.00488e32
mov eax, dword [ebp - 8]
cmp dword [eax - 0xc], 0
jne 0x488dc2
push dword [ebp + 8]
call fcn.004441b6
jmp 0x488e1a
push str.__o_enumsolutions
lea eax, [ebp - 8]
push eax
call fcn.00443470
lea eax, [ebp - 4]
call fcn.004432a9
push 0x4f2254
push edi
call fcn.00443470
push str.Solutions.list
push edi
call fcn.00443470
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x488e02
push dword [edi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [edi]
push dword [ebp - 8]
call fcn.00464547
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.00425ecf
lea ecx, [ebp - 8]
call fcn.00402907
lea ecx, [ebp - 4]
call fcn.00402907
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret