joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415110
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 2
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
mov esi, eax
test esi, esi
je 0x415194
push 0x10
push 1
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov edi, eax
test edi, edi
je 0x41518d
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push edi
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov edi, eax
test edi, edi
je 0x41518d
push edi
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [ebp - 8], eax
test eax, eax
je 0x415186
mov ecx, dword [ebp - 4]
push ecx
call fcn.0048c93d
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x415186
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
push edx
push eax
push ebx
call fcn.00491f60
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.DLL_FreeResource]
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor esi, esi
cmp ebx, esi
je 0x4151d2
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
push 0x4bd884
push ebx
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4151c9
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 8]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
mov esi, 1
push ebx
call fcn.0048c860
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4157c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp word [0x4e4908], 0
jne 0x415800
lea eax, [ebp - 4]
push eax
push 0x4e4908
lea ecx, [ebp - 8]
push ecx
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsQHSafeMain.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0x207
mov dword [ebp - 8], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [0x4e4b10], 0
jne 0x415826
push 0x4e4908
push 0x4c0418
push 0x104
push 0x4e4b10
call fcn.00414a30
add esp, 0x10
cmp word [0x4e4d18], 0
jne 0x415877
mov edx, 0x104
mov eax, 0x4e4d18
lea ebx, [ebx]
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x41586b
movzx ecx, word [eax - 0x410]
test cx, cx
je 0x41586b
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x415840
sub eax, 2
mov word [eax], dx
mov esp, ebp
pop ebp
ret
test edx, edx
jne 0x415872
sub eax, 2
xor edx, edx
mov word [eax], dx
mov esp, ebp
pop ebp
ret
Function at 0x419ed0
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 0x30]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x419f4e
mov eax, dword [0x4e51c0]
cmp dword [eax - 0xc], 0
je 0x419f09
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.DLL_OpenMutexW]
test eax, eax
jne 0x419f36
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
jne 0x419f3d
mov edx, dword [ebp + 0xc]
push 0
push edx
mov edx, dword [ebp + 8]
mov cl, 1
push esi
mov byte [0x4e4794], cl
call fcn.00418e10
lea eax, [esi + 0x1a0]
push eax
call fcn.0046c0d0
mov eax, dword [esi + 0x1c0]
pop ebp
ret 8
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [esi + 0x30]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi + 0x30], 0
mov eax, 2
pop ebp
ret 8
Function at 0x42a5b0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x42a5c3
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push esi
xor bl, bl
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x42a641
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
test esi, esi
je 0x42a633
mov eax, dword [ebp + 0x10]
push 0x4e2d14
push esi
mov dword [eax], esi
call fcn.0048bb06
mov ecx, dword [ebp + 0xc]
add esp, 8
mov dword [ecx], eax
test eax, eax
je 0x42a633
push 0
lea edx, [ebp - 4]
push edx
push esi
push eax
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x42a633
cmp dword [ebp - 4], esi
jne 0x42a633
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test bl, bl
jne 0x42a654
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
push esi
call fcn.0042a520
add esp, 0xc
mov bl, al
pop edi
mov al, bl
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42e880
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b56e0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4dbe18]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20]
push eax
push ecx
push edx
mov dword [ebp - 0x20], 0x60
call fcn.0042e4d0
mov edi, eax
add esp, 0xc
mov dword [ebp - 0x24], edi
test edi, edi
jne 0x42e8db
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
call fcn.0042e660
mov ecx, dword [edi + 4]
mov ebx, eax
add esp, 8
lea eax, [ebp - 0x18]
push eax
push ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0
call sub.gdiplus.dll_GdipGetImageWidth
test eax, eax
je 0x42e905
mov dword [edi + 8], eax
mov eax, dword [edi + 4]
lea edx, [ebp - 0x1c]
push edx
push eax
mov dword [ebp - 0x1c], 0
call sub.gdiplus.dll_GdipGetImageHeight
test eax, eax
je 0x42e920
mov dword [edi + 8], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
imul ecx, esi
mov edx, dword [ebp - 0x1c]
push esi
push eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], edx
call fcn.00408930
lea esi, [ebp - 0x2c]
call fcn.0042e270
test al, al
je 0x42e970
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
push ecx
push edx
mov eax, ebx
call fcn.0047ede0
mov esi, eax
add esp, 8
test esi, esi
je 0x42e970
test ebx, ebx
je 0x42e96b
mov eax, dword [ebx]
mov edx, dword [eax]
push 1
mov ecx, ebx
call edx
mov dword [ebp - 0x14], esi
mov ebx, esi
mov ecx, ebx
lea ebx, [ebp - 0x1c]
mov dword [ebp - 0x20], 0
call fcn.0047f2e0
mov dword [ebp - 4], 0
mov ebx, dword [ebp - 0x1c]
cmp dword [ebx - 0xc], 0
je 0x42e9f3
lea esi, [ebp - 0x18]
call fcn.00409c10
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x42e9dc
push ecx
mov eax, esp
mov dword [ebp - 0x20], esp
push eax
mov edi, str.disable_resize
call fcn.00409230
push ecx
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x28], esp
push ecx
mov edi, ebx
call fcn.00409230
mov byte [ebp - 4], 3
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00409b10
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
push ebx
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov byte [ebp - 4], 0
test esi, esi
je 0x42e9f3
mov edx, dword [esi]
mov eax, dword [edx + 8]
push esi
call eax
mov edx, dword [edi]
mov eax, dword [edx]
push 1
mov ecx, edi
call eax
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x42ea0c
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
lea eax, [ebx - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42ea2f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43d2b0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x4dbe18]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 1
push esi
push edi
cmp dword [0x4e6e5c], eax
jne 0x43d2ed
mov ecx, 0x45
mov esi, 0x4e6d48
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ac3c
mov esp, ebp
pop ebp
ret
push 0x4e6d48
mov dword [0x4e6e5c], eax
mov dword [0x4e6d48], 0x114
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
jne 0x43d3bc
push 0x3f
push eax
mov byte [ebp - 0x44], al
lea eax, [ebp - 0x43]
push eax
call fcn.0048f0a0
add esp, 0xc
lea ecx, [ebp - 0x4c]
push ecx
lea edx, [ebp - 0x44]
push edx
lea eax, [ebp - 0x48]
push eax
push str.CurrentVersion
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x4c], 0x40
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x43d37e
movsx ecx, byte [ebp - 0x44]
lea edx, [ebp - 0x42]
sub ecx, 0x30
push edx
mov dword [0x4e6d58], 2
mov dword [0x4e6d4c], ecx
call fcn.0048c358
add esp, 4
mov dword [0x4e6d50], eax
jmp 0x43d3bc
call dword [sym.imp.KERNEL32.DLL_GetVersion]
mov edx, eax
shr edx, 8
movzx edx, dl
movzx ecx, al
mov dword [0x4e6d50], edx
mov edx, 4
cmp edx, ecx
mov dword [0x4e6d4c], ecx
sbb ecx, ecx
neg ecx
inc ecx
mov dword [0x4e6d58], ecx
cmp eax, 0x80000000
jae 0x43d3bc
shr eax, 0x10
mov dword [0x4e6d54], eax
mov ecx, 0x45
mov esi, 0x4e6d48
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x4e6d4c]
cmp eax, 6
ja 0x43d3df
jne 0x43d41d
cmp dword [0x4e6d50], 2
jb 0x43d41d
push str.RtlGetVersion
push str.ntdll.dll
mov dword [0x4e6d48], 0x114
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x43d41d
push 0x4e6d48
call eax
test eax, eax
jne 0x43d41d
mov ecx, 0x45
mov esi, 0x4e6d48
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0048ac3c
mov esp, ebp
pop ebp
ret
Function at 0x43d9f0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4dbe18]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, esi
mov byte [esi + 0x410], 0
call fcn.0043dbb0
test al, al
jne 0x43da23
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ac3c
mov esp, ebp
pop ebp
ret
push ebx
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.0048f0a0
mov edi, dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
add esp, 0xc
push 0x103
lea edx, [ebp - 0x20c]
push edx
push str._SystemDrive_
call edi
cmp eax, 3
jne 0x43db91
push 2
lea eax, [ebp - 0x20c]
push eax
lea ebx, [esi + 0x208]
push ebx
call fcn.0048cf0d
add esp, 0xc
test eax, eax
jne 0x43db91
cmp word [ebp - 0x208], ax
jne 0x43db91
push 0x208
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0048f0a0
add esp, 0xc
push 0x103
lea edx, [ebp - 0x20c]
push edx
push str._windir_
call edi
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.0048b118
add esp, 8
test eax, eax
jne 0x43db91
push 0x208
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0048f0a0
add esp, 0xc
push 0x103
lea edx, [ebp - 0x20c]
push edx
push str._SystemRoot_
call edi
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.0048b118
add esp, 8
test eax, eax
jne 0x43db91
push 0x208
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0048f0a0
add esp, 0xc
push 0x103
lea edx, [ebp - 0x20c]
push edx
push str._ComSpec_
call edi
mov eax, esi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43db40
sub eax, edx
sar eax, 1
mov edi, eax
push edi
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.0048cf0d
add esp, 0xc
test eax, eax
jne 0x43db91
lea ecx, [ebp + edi*2 - 0x20c]
push str.cmd.exe
push ecx
call fcn.0048b118
add esp, 8
test eax, eax
jne 0x43db91
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ac3c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
mov byte [esi + 0x410], al
pop ebx
call fcn.0048ac3c
mov esp, ebp
pop ebp
ret

Function at 0x43dbb0
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, eax
cmp word [esi], 0
jne 0x43dbda
push 0x103
push esi
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
cmp eax, 3
jb 0x43dbd1
cmp eax, 0x104
jb 0x43dbda
xor eax, eax
mov word [esi], ax
xor al, al
pop esi
ret
add esi, 0x208
cmp word [esi], 0
jne 0x43dc07
push 0x103
push esi
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
cmp eax, 3
jb 0x43dbfe
cmp eax, 0x104
jb 0x43dc07
xor ecx, ecx
mov word [esi], cx
xor al, al
pop esi
ret
mov al, 1
pop esi
ret
Function at 0x43dc10
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4dbe18]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
push esi
push edi
mov esi, ecx
lea edi, [esi + 0x208]
push edi
push str.windir
call ebx
push edi
push str.SystemRoot
call ebx
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x21e]
push ecx
mov word [ebp - 0x220], ax
call fcn.0048f0a0
mov eax, dword [0x4c11ac]
mov edx, dword [str.cmd.exe]
mov ecx, dword [0x4c11b0]
mov dword [ebp - 0x14], eax
mov ax, word [0x4c11b8]
mov dword [ebp - 0x18], edx
mov edx, dword [0x4c11b4]
mov word [ebp - 8], ax
mov eax, esi
mov dword [ebp - 0xc], edx
add esp, 0xc
mov dword [ebp - 0x10], ecx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43dc94
sub eax, edx
lea ecx, [ebp - 0x220]
mov edx, ecx
sar eax, 1
mov edi, 0x104
sub esi, edx
lea edx, [edi + 0x7ffffefa]
test edx, edx
je 0x43dcd2
movzx edx, word [esi + ecx]
test dx, dx
je 0x43dcd2
mov word [ecx], dx
add ecx, 2
sub edi, 1
jne 0x43dcb2
jmp 0x43dcd6
test edi, edi
jne 0x43dcd9
sub ecx, 2
xor edx, edx
mov word [ecx], dx
mov ecx, 0x104
sub ecx, eax
lea edx, [ebp + eax*2 - 0x220]
je 0x43dcfe
cmp ecx, 0x7fffffff
ja 0x43dcfe
lea eax, [ebp - 0x18]
call fcn.0040dea0
lea eax, [ebp - 0x220]
push eax
push str.ComSpec
call ebx
lea edx, [ebp - 0x220]
push edx
xor ecx, ecx
push str.SystemDrive
mov word [ebp - 0x21c], cx
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048ac3c
mov esp, ebp
pop ebp
ret

Function at 0x43e180
Capabilities:
Get session information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x4dbe18]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x208
lea eax, [ebp - 0x620]
push 0
push eax
mov ebx, 1
mov byte [ebp - 0x210], 0
mov byte [ebp - 0x20f], 0
call fcn.0048f0a0
push 0x208
lea ecx, [ebp - 0x418]
push 0
push ecx
call fcn.0048f0a0
add esp, 0x18
lea esi, [ebp - 0x620]
call fcn.0043d9f0
test al, al
je 0x43e1fd
mov eax, esi
call fcn.0043dbb0
test al, al
je 0x43e21a
call fcn.0043d9f0
test al, al
je 0x43e21a
mov ecx, esi
call fcn.0043dc10
jmp 0x43e21a
push edi
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov ecx, eax
lea edi, [ebp - 0x620]
call fcn.0043d920
pop edi
test al, al
je 0x43e29b
push 0x206
xor esi, esi
lea eax, [ebp - 0x20a]
xor edx, edx
push esi
push eax
mov word [ebp - 0x20c], dx
call fcn.0048f0a0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
test eax, eax
je 0x43e29b
lea edx, [ebp - 0x628]
push edx
lea eax, [ebp - 0x624]
push eax
push 4
push 0xffffffffffffffff
push esi
mov dword [ebp - 0x628], esi
mov dword [ebp - 0x624], esi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x43e29b
mov ecx, dword [ebp - 0x624]
movzx edx, word [ecx]
mov ecx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x20c]
push eax
call fcn.0043df40
add esp, 8
test al, al
je 0x43e29b
xor ebx, ebx
mov ecx, dword [ebp - 4]
test ebx, ebx
setne al
pop esi
xor ecx, ebp
pop ebx
call fcn.0048ac3c
mov esp, ebp
pop ebp
ret
Function at 0x445950
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x445963
lea eax, [esi + 0xd]
pop esi
pop ebp
ret 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrlenW]
push edi
xor edi, edi
lea ecx, [ecx]
push esi
call ebx
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x445970
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push edi
push eax
mov eax, dword [edx]
push 7
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x446b70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4af716
mov eax, dword fs:[0]
push eax
sub esp, 0x428
mov eax, dword [0x4dbe18]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push esi
push edi
mov eax, dword [0x4dbe18]
xor eax, esp
push eax
lea eax, [esp + 0x438]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, ecx
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x440], ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], ecx
push 2
push ecx
push eax
mov byte [esp + 0x44c], 1
call dword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x446bf5
call fcn.00445320
mov esi, eax
jmp 0x446cc3
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov esi, eax
test esi, esi
jne 0x446c0e
call fcn.00445320
jmp 0x446cba
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x446c28
call fcn.00445320
jmp 0x446cba
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov ebx, eax
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x446c5f
lea eax, [esp + 0x28]
cmp dword [esp + 0x24], eax
je 0x446c4c
lea eax, [esp + 0x24]
call fcn.004459c0
lea ecx, [esp + 0x18]
call fcn.0043d0e0
mov eax, 0x8007000e
jmp 0x446ce2
lea esi, [esp + 0x24]
call fcn.004452e0
mov dword [esp + 0x440], 1
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x446c82
mov esi, 0x8007000e
jmp 0x446cbc
mov ecx, dword [esp + 0x14]
push ebx
push eax
push ebx
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
test eax, eax
jne 0x446c9f
call fcn.00445320
jmp 0x446cba
mov ecx, dword [esp + 0x24]
xor edx, edx
mov word [ecx + eax*2], dx
mov edx, dword [ebp + 0x10]
push edx
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x20]
call fcn.00446a10
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
lea eax, [esp + 0x28]
cmp dword [esp + 0x24], eax
je 0x446ce0
lea eax, [esp + 0x24]
call fcn.004459c0
jmp 0x446ce0
mov eax, esi
mov ecx, dword [esp + 0x438]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.0048ac3c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4483a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4af6d8
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x4dbe18]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov esi, dword [ebp + 8]
call fcn.004484e0
test eax, eax
je 0x4483fd
mov esi, dword [ebp + 8]
call fcn.00449860
mov esi, dword [ebp + 8]
call fcn.004484e0
test eax, eax
je 0x4483fd
mov ecx, dword [ebp + 8]
push ecx
call fcn.00449800
mov esi, dword [ebp + 8]
call fcn.004484e0
mov esi, eax
neg esi
sbb esi, esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
inc esi
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x448432
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x448450
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4af6d8
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x4dbe18]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
mov esi, dword [ebp + 8]
call fcn.004484e0
test eax, eax
je 0x448498
mov esi, dword [ebp + 8]
call fcn.004497b0
mov esi, dword [ebp + 8]
call fcn.004484e0
mov esi, eax
neg esi
sbb esi, esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
inc esi
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4484cd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4484e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [0x4e7008]
test eax, eax
jne 0x4484f3
call fcn.00449cf0
mov dword [0x4e7008], eax
mov eax, dword [eax + 0x140]
cmp eax, 2
jne 0x448516
mov eax, dword [0x4e7008]
mov ecx, dword [eax + 0x140]
cmp ecx, 2
jne 0x448516
mov eax, dword [eax + 0x88]
jmp 0x448518
xor eax, eax
push esi
test eax, eax
je 0x448521
call eax
jmp 0x448527
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x44853d
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov eax, edx
ret
mov eax, 1
ret
Function at 0x4497b0
Capabilities:
Delete directory

Disassembly:
mov eax, dword [0x4e7008]
test eax, eax
jne 0x4497c3
call fcn.00449cf0
mov dword [0x4e7008], eax
mov eax, dword [eax + 0x140]
cmp eax, 2
jne 0x4497e3
mov eax, dword [0x4e7008]
mov ecx, dword [eax + 0x140]
cmp ecx, 2
jne 0x4497e3
mov eax, dword [eax + 0x58]
jmp 0x4497e5
xor eax, eax
push esi
test eax, eax
je 0x4497ed
call eax
ret
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
ret

Function at 0x449860
Capabilities:
Delete file

Disassembly:
mov eax, dword [0x4e7008]
test eax, eax
jne 0x449873
call fcn.00449cf0
mov dword [0x4e7008], eax
mov eax, dword [eax + 0x140]
cmp eax, 2
jne 0x449893
mov eax, dword [0x4e7008]
mov ecx, dword [eax + 0x140]
cmp ecx, 2
jne 0x449893
mov eax, dword [eax + 0x50]
jmp 0x449895
xor eax, eax
push esi
test eax, eax
je 0x44989d
call eax
ret
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
ret

Function at 0x449ac0
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [0x4e7008]
test eax, eax
jne 0x449ad3
call fcn.00449cf0
mov dword [0x4e7008], eax
mov eax, dword [eax + 0x140]
cmp eax, 2
jne 0x449af6
mov eax, dword [0x4e7008]
mov ecx, dword [eax + 0x140]
cmp ecx, 2
jne 0x449af6
mov eax, dword [eax + 0x88]
jmp 0x449af8
xor eax, eax
push esi
test eax, eax
je 0x449b00
call eax
ret
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
ret

Function at 0x449d40
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [0x4e7008]
test eax, eax
jne 0x449d53
call fcn.00449cf0
mov dword [0x4e7008], eax
mov eax, dword [eax + 0x140]
cmp eax, 2
jne 0x449d73
mov eax, dword [0x4e7008]
mov ecx, dword [eax + 0x140]
cmp ecx, 2
jne 0x449d73
mov eax, dword [eax + 0x34]
jmp 0x449d75
xor eax, eax
push 0x80
push esi
test eax, eax
je 0x449d82
call eax
ret
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
ret
Function at 0x44a6e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4dbe18]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
xor ebx, ebx
cmp dword [esi + 0x14], ebx
je 0x44a723
cmp dword [ecx + 0x14], ebx
je 0x44a723
lea eax, [ebp - 0x20]
push eax
call fcn.0044a430
add esp, 4
cmp dword [ebp - 0xc], ebx
jne 0x44a735
cmp dword [ebp - 8], 0x10
jb 0x44a723
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00480ff0
add esp, 4
xor al, al
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ac3c
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x18], 8
jb 0x44a740
mov esi, dword [esi + 4]
jmp 0x44a743
add esi, 4
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x44a795
cmp dword [ebp - 8], 0x10
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], ebx
jae 0x44a76f
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
push ebx
lea edx, [ebp - 0x24]
push edx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x44a78e
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0xc]
jne 0x44a78e
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 8], 0x10
jb 0x44a7a7
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00480ff0
add esp, 4
mov ecx, dword [ebp - 4]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0048ac3c
mov esp, ebp
pop ebp
ret