joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c1c5
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [esi + 4], 0x100
jne 0x40c276
push 1
push 0
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_InvalidateRect]
cmp dword [esi + 8], 0x24
je 0x40c1f6
cmp dword [esi + 8], 0x23
jne 0x40c203
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jne 0x40c276
mov eax, dword [esi + 8]
cmp eax, 0x21
je 0x40c22e
cmp eax, 0x24
je 0x40c22e
cmp eax, 0x28
je 0x40c22e
cmp eax, 0x26
je 0x40c22e
cmp eax, 0x23
je 0x40c22e
cmp eax, 0x22
je 0x40c22e
cmp eax, 0xd
je 0x40c22e
cmp eax, 0x20
jne 0x40c276
push dword [edi + 0x20]
mov ebx, dword [sym.imp.USER32.dll_GetParent]
call ebx
push eax
call fcn.00548f8f
test eax, eax
je 0x40c276
push dword [edi + 0x20]
call ebx
push eax
call fcn.00548f8f
push dword [eax + 0x20]
call ebx
push eax
call fcn.00548f8f
test eax, eax
je 0x40c276
push dword [esi + 0xc]
push dword [esi + 8]
push 0x100
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
inc eax
jmp 0x40c27e
push esi
mov ecx, edi
call fcn.0054b071
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x40d879
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, ecx
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x40d896
push eax
mov ecx, esi
call fcn.00470e00
pop esi
pop ebp
ret 4

Function at 0x40eeda
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x14
mov eax, 0x5b1c26
call fcn.0057b6ec
lea ecx, [ebp - 0x20]
xor edi, edi
call fcn.00409295
mov dword [ebp - 4], edi
call fcn.004619a0
push dword [0x633b90]
mov ecx, eax
push dword [ebp + 0x10]
call fcn.0040ee3f
push 0xe
push dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40ef89
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov ebx, edi
cmp cx, word [eax + 4]
jae 0x40ef89
lea esi, [eax + 7]
mov cl, byte [esi - 1]
mov dword [ebp - 0x10], edi
test cl, cl
jne 0x40ef5a
cmp byte [esi], cl
jne 0x40ef5a
mov dword [ebp - 0x10], 0x100
mov eax, 0x100
jmp 0x40ef66
mov eax, edi
cmp cl, byte [esi]
jne 0x40ef66
movzx eax, cl
mov dword [ebp - 0x10], eax
cmp eax, dword [ebp - 0x14]
jb 0x40ef7a
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x20]
lea ecx, [ebp - 0x20]
call fcn.00409175
mov eax, dword [ebp - 0x18]
inc ebx
add esi, 0x10
movzx eax, word [eax + 4]
cmp ebx, eax
jl 0x40ef3e
cmp dword [ebp - 0x1c], 0
mov esi, dword [ebp - 0x20]
je 0x40efab
push esi
push dword [esi]
lea eax, [ebp - 0x18]
push eax
call fcn.0040eab1
mov eax, dword [ebp - 0x18]
add esp, 0xc
cmp eax, esi
je 0x40efab
mov edi, dword [eax + 8]
lea eax, [ebp - 0x20]
push esi
push eax
call fcn.004091fc
push 0xc
push dword [ebp - 0x20]
call fcn.0057b69e
add esp, 0x10
mov eax, edi
call fcn.0057b6ba
ret
Function at 0x41fdd9
Capabilities:
Delete file

Disassembly:
push 0x3c
mov eax, 0x5b2ded
call fcn.0057b71f
lea eax, [ebp - 0x48]
mov esi, 0x63c338
push eax
mov ecx, esi
call fcn.004060b5
mov eax, dword [eax]
xor edi, edi
push 7
xor ecx, ecx
mov dword [ebp - 0x40], edi
pop ebx
mov word [ebp - 0x40], cx
lea ecx, [ebp - 0x40]
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], ebx
call fcn.004048f3
mov ecx, dword [ebp - 0x48]
mov byte [ebp - 4], 2
lea ecx, [ecx - 0x10]
call fcn.004055b1
push 0x5ccdf8
lea ecx, [ebp - 0x40]
call fcn.00406557
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x44]
mov ecx, esi
push eax
call fcn.004060b5
mov eax, dword [eax]
xor ecx, ecx
mov dword [ebp - 0x28], edi
mov word [ebp - 0x28], cx
lea ecx, [ebp - 0x28]
push eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], ebx
call fcn.004048f3
mov ecx, dword [ebp - 0x44]
mov byte [ebp - 4], 5
lea ecx, [ecx - 0x10]
call fcn.004055b1
lea eax, [ebp - 0x28]
push eax
call fcn.0045a0c0
lea ecx, [ebp - 0x28]
mov dword [esp], 0x5ccda4
call fcn.00406557
lea eax, [ebp - 0x28]
push eax
call fcn.0045a0c0
lea eax, [ebp - 0x28]
push eax
call fcn.00458370
mov eax, dword [ebp - 0x14]
mov esi, 0x1000
pop ecx
pop ecx
cmp eax, 8
jb 0x41fee8
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
cmp eax, esi
jb 0x41fedf
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0040480e
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0057b69e
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x18], edi
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], ebx
cmp eax, 8
jb 0x41ff2e
mov ecx, dword [ebp - 0x40]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
cmp eax, esi
jb 0x41ff25
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0040480e
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.0057b69e
pop ecx
pop ecx
mov al, 1
call fcn.0057b6ce
ret

Function at 0x427465
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
push 0x11
mov edi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4274e6
push esi
lea eax, [ebp - 0xc]
mov ecx, edi
push eax
call fcn.0042590d
lea ecx, [ebp - 0xc]
mov esi, dword [eax + 4]
sub esi, dword [eax]
sar esi, 2
call fcn.00413e1f
cmp esi, 1
pop esi
ja 0x427502
mov eax, dword [ebp + 8]
sub eax, 0x45
je 0x4274dd
dec eax
sub eax, 1
je 0x4274d4
sub eax, 0xb
je 0x4274bd
sub eax, 5
jne 0x4274e6
push eax
push 0x8807
jmp 0x4274c4
push 0
push 0x8805
push 0x111
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x427504
push 0
push 0x8808
jmp 0x4274c4
push 0
push 0x8806
jmp 0x4274c4
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x427502
cmp dword [ebp + 8], 0x2e
jne 0x427502
push 0
push 0x8803
jmp 0x4274c4
xor eax, eax
pop edi
leave
ret 4
Function at 0x4379da
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4379f1
mov al, 1
jmp 0x437a12
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x437a00
push dword [ebp + 8]
call fcn.0043bf2b
push 4
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne al
pop esi
pop ebp
ret 4

Function at 0x437e99
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
xor edi, edi
mov eax, ecx
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push dword [eax + 0x164]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x437ece
xor eax, eax
jmp 0x437f23
push esi
push edi
push edi
push edi
push 2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
test esi, esi
jne 0x437eed
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x437f22
push edi
push edi
push edi
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 8], eax
test eax, eax
je 0x437f14
mov ecx, dword [ebp - 4]
push eax
call fcn.00438161
push dword [ebp - 8]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
mov eax, edi
pop esi
pop edi
pop ebx
leave
ret
Function at 0x43a2cc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push edi
call fcn.0043a217
test edi, edi
je 0x43a2fa
cmp dword [edi + 8], 0
je 0x43a2fa
push dword [ebx + 4]
push 0x5cfe30
push dword [edi + 8]
call fcn.0043bf34
add esp, 0xc
mov ecx, ebx
call fcn.0043ae29
test edi, edi
je 0x43a30a
mov eax, dword [edi + 8]
jmp 0x43a30c
xor eax, eax
push eax
mov ecx, ebx
call fcn.0043b250
mov eax, dword [ebx + 0x1c]
sub eax, dword [ebx + 0x18]
push 0x2c
cdq
pop ecx
idiv ecx
test eax, eax
je 0x43a35d
lea esi, [ebx + 4]
mov dword [ebp + 8], 0x7d0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x43a35d
cmp dword [ebp + 8], 0
jle 0x43a3a4
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub dword [ebp + 8], 0x64
mov esi, eax
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
lea esi, [ebx + 4]
je 0x43a33a
add ebx, 4
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [edi + 4]
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp + 8], 0
jne 0x43a40b
cmp eax, 5
jne 0x43a3d2
push ebx
push dword [0x63c770]
call fcn.0043b7d6
pop ecx
pop ecx
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x43a416
push 0x5cfe48
call fcn.0043bf2b
jmp 0x43a416
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x43a35d
push esi
push dword [0x63c770]
call fcn.0043b7d6
pop ecx
pop ecx
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x43a3ce
push 0x5cfe48
call fcn.0043bf2b
xor eax, eax
jmp 0x43a419
cmp eax, 2
jne 0x43a3e7
test esi, esi
je 0x43a3e2
mov ecx, esi
call fcn.00438482
xor eax, eax
inc eax
jmp 0x43a419
cmp dword [edi + 8], 0
je 0x43a3fe
push eax
push 0x5cfee0
push dword [edi + 8]
call fcn.0043bf34
add esp, 0xc
test esi, esi
je 0x43a416
mov ecx, esi
call fcn.00438482
jmp 0x43a416
test esi, esi
je 0x43a416
mov ecx, esi
call fcn.004384a6
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x43a420
Capabilities:
Check if file exists
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov ebx, ecx
push eax
call fcn.00435fb4
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
mov esi, eax
add ecx, 0xfffffff0
call fcn.004055b1
test esi, esi
je 0x43a499
mov esi, dword [ebp + 8]
mov ecx, ebx
push esi
call fcn.0043a26e
cmp dword [esi + 8], 0
mov edi, dword [esi + 4]
mov dword [ebp + 8], eax
je 0x43a478
push dword [ebx + 4]
push 0x5cfe30
push dword [esi + 8]
call fcn.0043bf34
mov eax, dword [ebp + 8]
add esp, 0xc
test eax, eax
je 0x43a4f5
lea eax, [ebx + 4]
push dword [eax]
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x43a4a3
test edi, edi
je 0x43a499
mov ecx, edi
call fcn.004384a6
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esi + 8], 0
mov ebx, eax
je 0x43a4c2
push ebx
push 0x5cff28
push dword [esi + 8]
call fcn.0043bf34
add esp, 0xc
cmp ebx, 0x20
jne 0x43a4e8
push dword [ebp + 8]
push dword [0x63c770]
call fcn.0043b7d6
pop ecx
pop ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43a4e8
push 0x5cff78
call fcn.0043bf2b
test edi, edi
je 0x43a506
mov ecx, edi
call fcn.00438482
jmp 0x43a506
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43a506
push 0x5d0020
call fcn.0043bf2b
xor eax, eax
jmp 0x43a49c

Function at 0x43ae29
Capabilities:
Set file attributes

Disassembly:
push 0x80
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
ret
Function at 0x43b250
Capabilities:
Create process on windows

Disassembly:
push 0x1c4
mov eax, 0x5b6822
call fcn.0057b71f
mov edi, dword [ebp + 8]
lea esi, [ecx + 4]
push esi
lea ecx, [ebp - 0x178]
call fcn.00437c90
and dword [ebp - 4], 0
lea ecx, [ebp - 0x178]
call fcn.00437e99
test eax, eax
je 0x43b3b0
push 0x5cfd0c
lea ecx, [ebp - 0x178]
call fcn.00437e4e
test eax, eax
je 0x43b3b0
push 0x5cfd1c
lea ecx, [ebp - 0x178]
call fcn.00437e4e
test eax, eax
je 0x43b3b0
push 0x5cfd30
lea ecx, [ebp - 0x178]
call fcn.00437e4e
test eax, eax
je 0x43b3b0
push 0x5cfd44
lea ecx, [ebp - 0x178]
call fcn.00437e4e
test eax, eax
je 0x43b3b0
test edi, edi
je 0x43b2f8
push 0x5cfd58
mov ecx, edi
call fcn.0043bf2b
push 0x44
pop ebx
push ebx
lea eax, [ebp - 0x1d0]
push 0
push eax
call fcn.0057e5f0
mov dword [ebp - 0x1d0], ebx
lea eax, [ebp - 0x18c]
push 0x10
xor ebx, ebx
push ebx
push eax
call fcn.0057e5f0
add esp, 0x18
lea ecx, [ebp - 0x17c]
call fcn.00404b89
push dword [esi]
lea eax, [ebp - 0x17c]
mov byte [ebp - 4], 1
push 0x5cfd88
push eax
call fcn.00404f83
mov esi, dword [ebp - 0x17c]
lea eax, [ebp - 0x18c]
add esp, 0xc
push eax
lea eax, [ebp - 0x1d0]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x43b398
push 0xbb8
push dword [ebp - 0x18c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x18c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x188]
call edi
jmp 0x43b3a8
test edi, edi
je 0x43b3a8
push 0x5cfdb8
mov ecx, edi
call fcn.0043bf2b
lea ecx, [esi - 0x10]
call fcn.004055b1
lea ecx, [ebp - 0x178]
call fcn.00437cfa
call fcn.0057b6ce
ret 4

Function at 0x43c8fc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ecx + 0x2c]
push edi
mov edi, dword [ecx + 0x30]
mov eax, edi
sub eax, esi
push 0x2c
cdq
pop ebx
idiv ebx
test eax, eax
je 0x43c9c1
call fcn.0043c4d0
test eax, eax
je 0x43c9c1
cmp esi, edi
je 0x43c9c1
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x43c947
push dword [esi + 4]
push 0x5d02c4
push ebx
call fcn.0043bf34
add esp, 0xc
push dword [esi + 4]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp + 8], eax
test eax, eax
je 0x43c99d
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x43c984
test ebx, ebx
je 0x43c984
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x5d02f0
push ebx
call fcn.0043bf34
add esp, 0xc
push 0x5dc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43c9b6
test ebx, ebx
je 0x43c9b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x5d0340
push ebx
call fcn.0043bf34
add esp, 0xc
add esi, 0x2c
cmp esi, edi
jne 0x43c932
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4432aa
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x634b28]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x2b8]
push edi
push 0x2b4
push 0
push eax
mov ebx, ecx
or edi, 0xffffffff
call fcn.0057e5f0
add esp, 0xc
lea eax, [ebp - 0x2b8]
push 0x101
push 0x2b4
push eax
push 0
push dword [esi]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x443327
cmp dword [ebp - 0x2b8], 0
je 0x443327
push dword [ebp - 0x2b8]
push edi
push dword [ebx + 0x84]
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
push dword [ebp - 0x2b8]
mov edi, eax
call dword [sym.imp.USER32.dll_DestroyIcon]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057b6ac
leave
ret 4

Function at 0x4557b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, ecx
call fcn.00454a90
mov edi, dword [ebp + 8]
push 0
push 0
push edi
call fcn.0058cc8e
push edi
call fcn.0058c57b
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4557fc
push edi
call fcn.0058c508
add esp, 4
test eax, eax
je 0x4557fc
push 0
push 0
push 5
push esi
call fcn.00456ec0
mov eax, dword [esi + 0x38]
add esp, 0x10
pop edi
pop esi
pop ebp
ret 4
push ebx
push 2
push 0
push edi
call fcn.0058cc8e
push edi
call fcn.0058d2e1
push 0
cdq
push 0
push edi
mov ebx, eax
mov dword [ebp + 8], edx
call fcn.0058cc8e
mov edx, dword [ebp + 8]
mov ecx, ebx
and ecx, edx
add esp, 0x1c
cmp ecx, 0xffffffff
je 0x455887
test edx, edx
jne 0x455887
cmp ebx, 0xffffffff
jae 0x455887
mov eax, ebx
or eax, edx
jne 0x455852
push eax
push eax
push 0xd
push esi
call fcn.00456ec0
mov eax, dword [esi + 0x38]
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 4
lea eax, [ebx + 1]
push eax
call fcn.005460f3
push edi
push ebx
push 1
push eax
mov dword [esi + 0x50], eax
call fcn.0058c878
add esp, 0x14
cmp eax, ebx
jne 0x455887
mov eax, dword [esi + 0x50]
mov ecx, esi
mov byte [ebx + eax], 0
call fcn.00455bf0
mov eax, dword [esi + 0x38]
pop ebx
pop edi
pop esi
pop ebp
ret 4
push 0
push 0
push 5
push esi
call fcn.00456ec0
mov eax, dword [esi + 0x38]
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 4
Function at 0x4580b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 1
push 0
push 0
push dword [ebp + 8]
push 0x5cc6ec
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
cmovle eax, ecx
pop ebp
ret

Function at 0x458370
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x634b28]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor al, al
push edi
mov edi, dword [esi + 0x10]
test edi, edi
je 0x458439
cmp edi, 0x104
jae 0x458439
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0057e5f0
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x4583bf
mov esi, dword [esi]
lea eax, [edi + edi]
push eax
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0057e070
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x224], eax
add esp, 0xc
mov eax, 0x414
mov dword [ebp - 0x220], 0
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x21a], 0
push eax
mov dword [ebp - 0x216], 0
mov dword [ebp - 0x212], 0
mov dword [ebp - 0x228], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0057b6ac
mov esp, ebp
pop ebp
ret
Function at 0x459430
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x634b28]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x804]
push 0
push dword [ebp + 0xc]
mov dword [ebp - 0x808], esi
push eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov dword [esi], 0
lea ecx, [ebp - 0x804]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
lea edx, [ecx + 2]
mov word [esi], ax
jmp 0x459490
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x459490
sub ecx, edx
lea eax, [ebp - 0x804]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040491a
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0057b6ac
mov esp, ebp
pop ebp
ret
Function at 0x4594c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b8927
mov eax, dword fs:[0]
push eax
sub esp, 0x814
mov eax, dword [0x634b28]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x818], esi
mov dword [ebp - 0x81c], 0
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x810]
push eax
push 0x400
mov dword [ebp - 0x81c], 1
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x459687
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x459550
sub ecx, edx
lea eax, [ebp - 0x810]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040491a
mov edi, dword [esi + 0x10]
test edi, edi
je 0x459687
lea eax, [edi - 1]
cmp edi, eax
jbe 0x4596a5
mov ecx, dword [esi + 0x14]
mov edx, esi
mov dword [ebp - 0x820], ecx
cmp ecx, 8
jb 0x459596
mov edx, dword [esi]
cmp word [edx + eax*2], 0x5c
je 0x459687
cmp edi, ecx
jae 0x4595c0
lea eax, [edi + 1]
mov dword [esi + 0x10], eax
mov eax, esi
cmp ecx, 8
jb 0x4595b4
mov eax, dword [esi]
mov dword [eax + edi*2], 0x5c
jmp 0x459687
mov edx, SysReAllocString
mov eax, edx
sub eax, edi
cmp eax, 1
jb 0x4596aa
lea ebx, [edi + 1]
or ebx, 7
cmp ebx, edx
jbe 0x4595e0
mov ebx, edx
jmp 0x4595f8
mov eax, ecx
shr eax, 1
sub edx, eax
cmp ecx, edx
jbe 0x4595f1
mov ebx, SysReAllocString
jmp 0x4595f8
add eax, ecx
cmp ebx, eax
cmovb ebx, eax
lea eax, [ebx + 1]
mov ecx, esi
push eax
call fcn.004048d3
lea ecx, [edi + 1]
mov dword [esi + 0x14], ebx
mov ebx, dword [ebp - 0x820]
mov dword [esi + 0x10], ecx
lea ecx, [edi + edi]
mov dword [ebp - 0x814], eax
lea edi, [ecx + eax]
mov dword [ebp - 0x818], edi
push ecx
cmp ebx, 8
jb 0x45966f
mov edi, dword [esi]
push edi
push eax
call fcn.0057e070
mov eax, dword [ebp - 0x818]
lea ebx, [ebx*2 + 2]
add esp, 0xc
mov dword [eax], 0x5c
cmp ebx, 0x1000
jb 0x459663
mov ecx, dword [edi - 4]
add ebx, 0x23
sub edi, ecx
lea eax, [edi - 4]
cmp eax, 0x1f
ja 0x4596af
mov edi, ecx
push ebx
push edi
call fcn.0057b69e
add esp, 8
jmp 0x45967f
push esi
push eax
call fcn.0057e070
add esp, 0xc
mov dword [edi], 0x5c
mov eax, dword [ebp - 0x814]
mov dword [esi], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057b6ac
mov esp, ebp
pop ebp
ret
call fcn.004048b9
call fcn.004048ae
call fcn.00582360
int3
Function at 0x45a200
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b8a95
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x634b28]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 8]
xor bl, bl
test edx, edx
je 0x45a3f5
cmp word [edx], 0
je 0x45a3f5
mov ecx, edx
mov dword [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45a262
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0040491a
push 0
push 0x5ce15c
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push 0x5d280c
push eax
call fcn.0040dccc
mov ecx, dword [ebp - 0x18]
add esp, 0x10
cmp ecx, 2
jbe 0x45a39b
cmp ecx, 1
jbe 0x45a413
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edi, dword [ebp - 0x28]
cmp esi, 8
cmovae eax, edi
cmp word [eax + 2], 0x3a
jne 0x45a3a1
push 4
push 0x5d297c
cmp esi, 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, edi
push ecx
push eax
call fcn.0040dbfe
add esp, 0x14
cmp eax, 0xffffffff
jne 0x45a3a1
push 0x5d2988
lea ecx, [ebp - 0x58]
call fcn.0042e318
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x28]
push ecx
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0040657e
mov edx, eax
mov ecx, dword [edx]
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x40], ecx
mov ecx, dword [edx + 4]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [edx + 8]
mov dword [ebp - 0x38], ecx
mov ecx, dword [edx + 0xc]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x34], ecx
mov ecx, dword [edx + 0x10]
mov word [edx], ax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x28]
push eax
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 7
call fcn.0041d69d
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x45a393
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45a389
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45a418
push edx
push ecx
call fcn.0057b69e
add esp, 8
lea ecx, [ebp - 0x58]
call fcn.004047c6
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 0x14]
cmp esi, 8
lea eax, [ebp - 0x28]
cmovae eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, dword [ebp - 0x14]
cmp eax, 0xffffffff
movzx ebx, bl
mov ecx, 1
cmovne ebx, ecx
cmp edx, 8
jb 0x45a3f5
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45a3eb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45a41d
push edx
push ecx
call fcn.0057b69e
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057b6ac
mov esp, ebp
pop ebp
ret
call fcn.004048b9
call fcn.00582360
call fcn.00582360
int3