joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b635
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2024
call fcn.00496b20
mov eax, dword [0x54a708]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [eax]
xor eax, eax
cmp dword [esi - 0xc], eax
je 0x41b6c2
push edi
push 7
pop ecx
lea edi, [ebp - 0x2024]
rep stosd dword es:[edi], eax
push 0x2000
push 0
stosw word es:[edi], ax
lea eax, [ebp - 0x2004]
push eax
mov dword [ebp - 0x2020], 3
call fcn.004d8620
push 0x1000
lea eax, [ebp - 0x2004]
push esi
push eax
call fcn.004def12
lea eax, [ebp - 0x2004]
add esp, 0x18
mov dword [ebp - 0x201c], eax
mov eax, 0x614
mov word [ebp - 0x2014], ax
lea eax, [ebp - 0x2024]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
xor eax, eax
inc eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00496914
leave
ret 4

Function at 0x41b796
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push 0x210
mov eax, 0x502ecf
call fcn.00496990
push 0x208
xor edi, edi
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.004d8620
add esp, 0xc
lea eax, [ebp - 0x218]
mov ebx, 0x104
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.config.ini
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41b899
mov dword [ebp - 4], edi
call fcn.00404f6e
push eax
lea ecx, [ebp - 0x21c]
call fcn.004047db
push ebx
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], 1
call fcn.00405303
push ebx
lea ecx, [ebp - 0x21c]
mov esi, eax
call fcn.0040546c
lea eax, [ebp - 0x218]
push eax
push ebx
push esi
push 0x50d0a8
push str.state
push str.update
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x21c]
call fcn.00405440
mov esi, dword [ebp - 0x21c]
push str.ADBlockMasterUpdate
push esi
call fcn.0041ba7d
pop ecx
pop ecx
test eax, eax
je 0x41b88c
push str.bigupdate
push esi
call fcn.0041ba7d
pop ecx
pop ecx
test eax, eax
jne 0x41b88f
xor edi, edi
inc edi
lea ecx, [esi - 0x10]
call fcn.00405428
mov eax, edi
call fcn.0049693a
ret

Function at 0x41c4cb
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x54a708]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
xor edi, edi
mov dword [ebp - 0x210], esi
push edi
push eax
call fcn.004d8620
add esp, 0xc
lea eax, [ebp - 0x20c]
push edi
push 0x1a
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41c540
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00406343
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00496914
leave
ret
Function at 0x41c789
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1058
call fcn.00496b20
mov eax, dword [0x54a708]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x1058]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x44
pop edi
push edi
push 0
push eax
call fcn.004d8620
add esp, 0xc
mov dword [ebp - 0x1058], edi
lea eax, [ebp - 0x1058]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
mov dword [ebp - 0x102c], 1
mov word [ebp - 0x1028], ax
lea edi, [ebp - 0x1014]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0x41c83a
push 0x1000
xor edi, edi
lea eax, [ebp - 0x1004]
push edi
push eax
call fcn.004d8620
push ebx
push esi
lea eax, [ebp - 0x1004]
push str.__s___s
push eax
call fcn.0041c159
add esp, 0x1c
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1058]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x1004]
push eax
push edi
jmp 0x41c852
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1058]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test edi, edi
je 0x41c874
push dword [ebp - 0x1010]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1014]
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00496914
leave
ret
Function at 0x41ff40
Capabilities:
Delete file
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x503203
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x54a708]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], 0
test esi, esi
je 0x41ffe5
cmp word [esi], di
je 0x41ffe5
test eax, eax
je 0x41ffa1
cmp word [eax], di
je 0x41ffa1
push edi
push edi
push eax
push esi
push edi
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
js 0x41ffe5
jmp 0x41ffe0
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004d8620
add esp, 0xc
lea eax, [ebp - 0x420]
push 0
push 0
push 0x104
push eax
push esi
push 0
call sub.urlmon.dll_URLDownloadToCacheFileW
test eax, eax
js 0x41ffe5
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, 1
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x42004b
lea esi, [ebx + 0x38]
mov dword [ebp - method._BaseModule::CAutoLocker.virtual_0], vtable._BaseModule::CAutoLocker.0
mov dword [ebp - 0x428], esi
test esi, esi
je 0x42000b
mov eax, dword [esi]
push esi
call dword [eax]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 1
mov dword [ebp - 0x424], edi
test ecx, ecx
je 0x42006b
mov eax, dword [ecx]
lea edx, [ebp - 0x424]
push edx
call dword [eax + 8]
mov byte [ebp - 4], 2
test esi, esi
je 0x420033
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x42004b
mov edx, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00496914
mov esp, ebp
pop ebp
ret 0x30
call fcn.0041d3f3
int3
Function at 0x421150
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x54a708]
xor eax, ebp
mov dword [ebp - 4], eax
cmp word [0x551a10], 0
push esi
jne 0x421277
cmp dword [ecx + 0x2c], 8
lea eax, [ecx + 0x18]
mov dword [ebp - 0x818], 0
mov dword [ebp - 0x814], 0
mov dword [ebp - 0x810], 0
jb 0x42119b
mov eax, dword [eax]
push edi
push 0x20219
push eax
push dword [ecx + 0x30]
lea ecx, [ebp - 0x818]
call fcn.0040fa50
mov edi, dword [ebp - 0x818]
test eax, eax
jne 0x42126b
lea eax, [ebp - 0x808]
mov dword [ebp - 0x808], 0x800
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x80c]
push eax
push 0
push 0x5118d4
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42126b
mov eax, dword [ebp - 0x80c]
cmp eax, 1
je 0x4211ff
cmp eax, 2
jne 0x42126b
mov eax, dword [ebp - 0x808]
test eax, eax
je 0x42121c
test al, 1
jne 0x42126b
shr eax, 1
cmp word [ebp + eax*2 - 0x806], 0
je 0x421225
jmp 0x42126b
xor eax, eax
mov word [ebp - 0x804], ax
mov ecx, 0x551a10
lea esi, [ebp - 0x804]
mov edx, 0x3ff
sub esi, ecx
nop word [eax + eax]
lea eax, [edx + 0x7ffffbff]
test eax, eax
je 0x42125e
movzx eax, word [esi + ecx]
test ax, ax
je 0x42125e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x421240
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
test edi, edi
je 0x421276
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
push 0x551a10
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jg 0x4212cb
mov ecx, 0x551a10
mov esi, str.noset
mov edx, 0x3ff
sub esi, ecx
nop word [eax + eax]
lea eax, [edx + 0x7ffffbff]
test eax, eax
je 0x4212be
movzx eax, word [esi + ecx]
test ax, ax
je 0x4212be
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x4212a0
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 4]
mov eax, 0x551a10
xor ecx, ebp
pop esi
call fcn.00496914
mov esp, ebp
pop ebp
ret
Function at 0x429010
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
test ax, ax
mov ecx, 8
push 2
cmovs esi, ecx
call edi
test ax, ax
jns 0x429035
or esi, 1
push 1
call edi
test ax, ax
jns 0x429041
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x42904d
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x429059
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x42be30
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
push esi
push edi
xor esi, esi
lea ecx, [ebx + 0xe0]
call fcn.00425a60
mov edi, dword [ebp + 8]
test eax, eax
jle 0x42be8b
nop
push esi
lea ecx, [ebx + 0xe0]
mov byte [ebp + 0xb], 0
call fcn.00425330
lea ecx, [ebp + 0xb]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push edi
call dword [edx]
cmp byte [ebp + 0xb], 0
jne 0x42bfbc
lea ecx, [ebx + 0xe0]
inc esi
call fcn.00425a60
cmp esi, eax
jl 0x42be50
sub edi, 0x100
je 0x42bf51
sub edi, 4
je 0x42bef2
sub edi, 2
jne 0x42bf46
push dword [ebp + 0xc]
mov dword [ebp + 8], edi
call fcn.004df2e4
mov ecx, dword [ebx + 0x58]
lea edx, [ebp + 8]
add esp, 4
mov word [ebp + 8], ax
mov eax, dword [ecx]
push VariantTimeToDosDateTime
push edx
push 0x42dca0
call dword [eax + 0x14c]
mov esi, eax
test esi, esi
je 0x42bf46
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x13c]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x1c]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebx + 0x5c], 0
je 0x42bf46
xor eax, eax
mov dword [ebp - 0x20], 6
mov word [ebp - 2], ax
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
mov eax, dword [ebx + 0x70]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x74]
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0xa], xmm0
mov dword [ebp - 0x10], eax
call fcn.00429010
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x5c]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + pe_nt_image_headers32]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x42bf46
mov ecx, dword [ebx + 0x5c]
test ecx, ecx
je 0x42bfa3
mov eax, dword [ecx]
mov eax, dword [eax + 0x110]
call eax
test al, al
je 0x42bfa3
mov ecx, dword [ebx + 0x5c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x11c]
call eax
test al, al
je 0x42bfa3
mov ecx, dword [ebx + 0x5c]
push str.RichEditUI
mov eax, dword [ecx]
call dword [eax + 0x10]
push eax
call fcn.004d7480
add esp, 8
test eax, eax
je 0x42bfa3
mov ecx, dword [ebx + 0x5c]
call fcn.00440850
test al, al
jne 0x42bf46
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, ebx
setns al
movzx eax, al
push eax
call fcn.0042d440
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42e550
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], 0
push 4
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindow]
push 1
push dword [esi + 4]
mov edi, eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
mov esi, dword [esi + 4]
xorps xmm0, xmm0
push esi
movups xmmword [ebp - 0x20], xmm0
xor ebx, ebx
mov dword [ebp - 8], 0
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42e619
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x42e619
cmp dword [ebp - 0x1c], 0x10
jne 0x42e5e0
cmp dword [ebp - 0x20], esi
jne 0x42e5e0
mov eax, dword [ebp - 0x18]
push 1
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_EnableWindow]
push edi
call dword [sym.imp.USER32.dll_SetFocus]
mov ebx, 1
lea eax, [ebp - 0x20]
push eax
call fcn.0042da30
add esp, 4
test al, al
jne 0x42e604
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 0x1c], 0x12
je 0x42e619
test ebx, ebx
jne 0x42e619
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x42e5a6
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
push edi
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [ebp - 0x1c], 0x12
pop edi
pop esi
pop ebx
jne 0x42e63b
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x42e650
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42e695
cmp byte [ebp + 8], 0
je 0x42e689
cmp byte [ebp + 0xc], 0
mov ecx, 1
mov eax, 4
cmovne eax, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
xor eax, eax
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
Function at 0x43e170
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
movzx eax, word [edi + 0xc]
sub eax, 0x41
je 0x43e1d2
sub eax, 2
je 0x43e1b3
sub eax, 0x15
jne 0x43e222
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x43e222
push 0
push edi
push dword [ebp + 0xc]
push str.cutkey
jmp 0x43e217
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x43e222
push 0
push edi
push dword [ebp + 0xc]
push str.copykey
jmp 0x43e217
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x43e222
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x2c], 2
push eax
mov eax, dword [esi + 0x14]
push 0xffffffffffffffff
push 0x102b
mov dword [ebp - 0x30], 2
push dword [eax + 0x558]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push edi
push dword [ebp + 0xc]
push str.selectallkey
push dword [esi + 0x14]
mov ecx, dword [esi + 0x10]
call fcn.0042c710
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x43ed10
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push dword [ebp + 8]
mov ebx, ecx
call fcn.004328e0
push dword [ebx + 0x558]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43ed5e
mov ecx, dword [ebx + 0x55c]
mov eax, 5
push edi
xor edi, edi
cmp byte [ebp + 8], 0
cmovne edi, eax
push edi
call fcn.00425a60
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
push dword [ebx + 0x558]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop ebx
pop ebp
ret 4

Function at 0x4422f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x594], 0
je 0x44235d
cmp dword [ebp + 8], 0x100
jne 0x44234d
cmp word [ebp + 0xc], 0xd
jne 0x44234d
cmp byte [esi + 0x59a], 0
je 0x44232e
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x44234d
cmp byte [esi + 0x59b], 0
jne 0x44234d
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x442346
push 0
push 0
push 0
push str.return
push esi
call fcn.0042c710
xor eax, eax
pop esi
pop ebp
ret 0x10
mov eax, dword [esi + 0x594]
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
mov eax, 1
pop esi
pop ebp
ret 0x10
Function at 0x4432a0
Capabilities:
Check if file exists
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x550cce
push 0x34
call fcn.00496b4d
mov esi, eax
add esp, 8
mov dword [ebp - 4], esi
test esi, esi
je 0x443319
mov dword [esi], 2
mov dword [esi + 4], 0xffffffff
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
jmp 0x44331b
xor esi, esi
push ebx
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x14], 8
jb 0x443328
mov edi, dword [edi]
xor ebx, ebx
test edi, edi
je 0x44339f
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44339f
push ebx
push 0x80
push 3
push ebx
push 1
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x44339f
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x14], eax
cmp eax, 0x16
jb 0x44339f
push ebx
push ebx
push ebx
push 2
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 8], eax
test eax, eax
je 0x44339f
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xc], eax
test eax, eax
je 0x44339f
push dword [esi + 0x14]
mov ecx, esi
push eax
call fcn.00442c20
mov ebx, eax
test ebx, ebx
jne 0x4433cd
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4433b4
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 0xc], 0
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4433d3
push eax
call edi
mov dword [esi + 8], 0
jmp 0x4433d3
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x4433e5
push eax
call edi
mov dword [esi + 4], 0xffffffff
pop edi
test ebx, ebx
pop ebx
jne 0x443404
mov ecx, esi
call fcn.004428e0
push 0x34
push esi
call fcn.0049666c
add esp, 8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4487d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
push 0x550cce
cmp al, 6
jb 0x44880d
push 0x18
call fcn.00496b4d
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
je 0x448849
mov ecx, eax
call fcn.00448860
mov dword [esi], eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 0x14
call fcn.00496b4d
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
je 0x448849
mov dword [eax], vtable.CGDIPlusImageImpl.0
mov dword [eax + 4], 6
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [esi], eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [esi], eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44a9f0
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x504dd8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x54a708]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x44ab9e
cmp ebx, 7
jb 0x44ab9e
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x44aaf8
test esi, esi
je 0x44aa5c
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [ebp - 0x28]
push eax
call fcn.004580b0
add esp, 4
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x80
push 2
push 0
push 0
push 0xc0000000
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x44aaab
lea ecx, [ebp - 0x28]
xor esi, esi
call fcn.004068bd
mov eax, esi
jmp 0x44aba0
push 0
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0
push eax
push ebx
push dword [ebp - 0x2c]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi]
lea ecx, [ebp - 0x28]
push ecx
mov ecx, edi
call dword [eax + 4]
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
mov esi, eax
cmovae ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x28]
call fcn.004068bd
mov eax, esi
jmp 0x44aba0
push ebx
push dword [ebp - 0x2c]
push eax
call fcn.004d7b20
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x44ab20
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [edi + 0x10], 0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push eax
push 1
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ebx, dword [ebp - 0x30]
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov esi, eax
test esi, esi
je 0x44ab66
lea eax, [ebp - 0x2c]
mov dword [esi], vtable.Gdiplus::Bitmap.0
push eax
push ebx
mov dword [ebp - 0x2c], 0
call sub.gdiplus.dll_GdipCreateBitmapFromStream
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esi + 4], eax
jmp 0x44ab68
xor esi, esi
mov dword [edi + 0x10], esi
test esi, esi
je 0x44ab8b
mov ecx, esi
call fcn.0044a520
mov ecx, dword [edi + 0x10]
mov dword [edi + 8], eax
call fcn.0044a4d0
mov dword [edi + 0xc], eax
mov esi, 1
jmp 0x44ab8d
xor esi, esi
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x44ab9a
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, esi
jmp 0x44aba0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00496914
mov esp, ebp
pop ebp
ret 8

Function at 0x44b620
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
cmp dword [ecx + 0x10], 0
jne 0x44b62f
xor eax, eax
pop ebp
ret 4
pop ebp
jmp fcn.0044a1a0
Function at 0x4580b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x504fab
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x54a708]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x43c], esi
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 7
mov word [ebp - 0x438], ax
push 0x208
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x420]
push eax
call fcn.004d8620
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4581f1
cmp eax, 0x104
ja 0x4581f1
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004d8620
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0x5150e0
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x4581a2
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x458180
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x438]
call fcn.004096f8
movups xmm0, xmmword [ebp - 0x438]
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x438]
mov dword [esi + 0x14], 0
xor eax, eax
movups xmmword [esi], xmm0
mov word [ebp - 0x438], ax
movq xmm0, qword [ebp - 0x428]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 7
call fcn.004068bd
jmp 0x458216
movups xmm0, xmmword [ebp - 0x438]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x428]
movq qword [esi + 0x10], xmm0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00496914
mov esp, ebp
pop ebp
ret