joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cb68
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call dword [sym.imp.kernel32.dll_GetVersion]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x80000000
jae 0x40cc1e
mov dword [ebp - 8], 1
push 0x94
call fcn.004fa109
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40cc19
push 0x94
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.004fa910
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [ecx], 0x94
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GetVersionExA]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 4
jne 0x40cbd9
mov dword [ebp - 8], 5
jmp 0x40cc0d
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 5
jne 0x40cbf4
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
jne 0x40cbf4
mov dword [ebp - 8], 6
jmp 0x40cc0d
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 5
jne 0x40cc0d
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 1
jne 0x40cc0d
mov dword [ebp - 8], 7
mov edx, dword [ebp - 4]
push edx
call fcn.004f9aad
add esp, 4
jmp 0x40ccba
mov eax, dword [ebp - 0xc]
and eax, 0xff
cmp eax, 4
jge 0x40cc37
mov dword [ebp - 8], 0
jmp 0x40ccba
mov dword [ebp - 8], 2
push 0x94
call fcn.004fa109
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40ccba
push 0x94
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.004fa910
add esp, 0xc
mov edx, dword [ebp - 4]
mov dword [edx], 0x94
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.kernel32.dll_GetVersionExA]
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 4
jne 0x40cc95
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0xa
jne 0x40cc95
mov dword [ebp - 8], 3
jmp 0x40ccae
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 4
jne 0x40ccae
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0x5a
jne 0x40ccae
mov dword [ebp - 8], 4
mov edx, dword [ebp - 4]
push edx
call fcn.004f9aad
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4142b9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.00416810
mov dword [ebp - 4], eax
push 2
mov eax, dword [ebp + 8]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x414305
mov dword [ebp - 4], 0
push 2
mov edx, dword [ebp + 8]
and edx, 0xffff
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x41430f
xor eax, eax
jmp 0x41437b
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x41432a
xor eax, eax
jmp 0x41437b
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.kernel32.dll_LockResource_1]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x414341
xor eax, eax
jmp 0x41437b
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0041426a
add esp, 4
mov word [ebp - 0xc], ax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.kernel32.dll_FreeResource]
mov eax, dword [ebp - 0xc]
and eax, 0xffff
cmp eax, 0x10
je 0x41436c
xor eax, eax
jmp 0x41437b
push 0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0051ccbb
mov esp, ebp
pop ebp
ret

Function at 0x415a5c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push esi
push edi
cmp dword [0x5706e8], 0
je 0x415a7a
mov eax, dword [0x5706e4]
jmp 0x415b7e
mov dword [0x5706e8], 1
lea eax, [ebp - 0x11c]
push eax
push 0x20019
push 0
push 0x55d748
push 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jne 0x415b79
mov dword [ebp - 4], 0x104
mov dword [ebp - 0x118], 1
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x114]
push edx
lea eax, [ebp - 0x118]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x11c]
push ecx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jne 0x415b6c
mov ecx, 5
mov esi, 0x55d770
lea edi, [ebp - 0x138]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.kernel32.dll_lstrlen]
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.kernel32.dll_lstrlen]
cmp dword [ebp - 0x13c], eax
jl 0x415b6c
lea ecx, [ebp - 0x138]
push ecx
lea edx, [ebp - 0x138]
push edx
call dword [sym.imp.kernel32.dll_lstrlen]
mov ecx, dword [ebp - 0x13c]
sub ecx, eax
lea edx, [ebp + ecx - 0x114]
push edx
call dword [sym.imp.kernel32.dll_lstrcmpi]
test eax, eax
jne 0x415b6c
mov dword [0x5706e4], 1
mov eax, dword [ebp - 0x11c]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [0x5706e4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x427173
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.shlwapi.dll_PathFileExistsA]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
cmp dword [ebp - 8], 0
je 0x4271f6
cmp dword [ebp - 0xc], 0x3e8
jl 0x4271d2
mov ecx, dword [ebp + 8]
push ecx
push 0x55ecd4
lea edx, [ebp - 0x20c]
push edx
call fcn.004fa9f4
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0051c1dd
xor eax, eax
jmp 0x4271fb
mov ecx, dword [ebp + 8]
push ecx
call fcn.00426c8e
add esp, 4
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.shlwapi.dll_PathFileExistsA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x427197
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x428ac3
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x535c10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x148
mov eax, dword [ebp + 8]
push eax
call fcn.004fa680
add esp, 4
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + eax - 1]
cmp edx, 0x5c
jne 0x428b14
mov eax, dword [ebp + 8]
push eax
push 0x55edd4
lea ecx, [ebp - 0x130]
push ecx
call fcn.004fa9f4
add esp, 0xc
jmp 0x428b2c
mov edx, dword [ebp + 8]
push edx
push 0x55eddc
lea eax, [ebp - 0x130]
push eax
call fcn.004fa9f4
add esp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.004f2671
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 0x130]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.004f2734
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x428c55
lea ecx, [ebp - 0x2c]
call fcn.004f2954
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x2c]
call fcn.004f291b
test eax, eax
jne 0x428c50
mov dword [ebp - 0x134], 0
lea ecx, [ebp - 0x2c]
call fcn.00428d30
test eax, eax
je 0x428bda
lea edx, [ebp - 0x138]
push edx
lea ecx, [ebp - 0x2c]
call fcn.004f2a23
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x14c], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14c]
call fcn.00409600
push eax
call fcn.00428ac3
add esp, 4
mov dword [ebp - 0x134], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x138]
call fcn.00513ced
jmp 0x428c26
lea ecx, [ebp - 0x13c]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.004f2a23
mov dword [ebp - 0x150], eax
mov edx, dword [ebp - 0x150]
mov dword [ebp - 0x154], edx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x154]
call fcn.00409600
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov dword [ebp - 0x134], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x13c]
call fcn.00513ced
cmp dword [ebp - 0x134], 0
jne 0x428c50
mov dword [ebp - 0x140], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.004f26ae
mov eax, dword [ebp - 0x140]
jmp 0x428c82
jmp 0x428b4f
lea ecx, [ebp - 0x2c]
call fcn.004f26ea
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
mov dword [ebp - 0x144], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.004f26ae
mov eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4377bd
Capabilities:
Check mutex on windows
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5362ae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
mov dword [ebp - 0x11c], ecx
push 0x55faac
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateMutexA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x437924
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
jne 0x437924
mov eax, dword [ebp - 0x11c]
mov dword [eax + 0x3c4], 1
cmp dword [ebp + 0xc], 0
je 0x437838
push 2
push 0x4376ac
call dword [sym.imp.user32.dll_EnumWindows]
xor eax, eax
jmp 0x437929
lea ecx, [ebp - 0x14]
call fcn.004016b0
mov dword [ebp - 4], 0
push 0xe004
lea ecx, [ebp - 0x14]
call fcn.00514c73
push 0
push 0
lea ecx, [ebp - 0x14]
call fcn.00409600
push eax
call fcn.0051c1dd
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00513ced
mov ecx, dword [ebp + 8]
add ecx, 0x14
call fcn.004165f0
test eax, eax
jne 0x437913
mov ecx, dword [ebp + 8]
add ecx, 0x14
call fcn.00409600
push eax
lea ecx, [ebp - 0x118]
push ecx
call fcn.004fa590
add esp, 8
push 0x2e
lea edx, [ebp - 0x118]
push edx
call fcn.004fbe40
add esp, 8
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
call fcn.0050c73f
add esp, 4
push 0x55fab8
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.004fa970
add esp, 8
test eax, eax
je 0x437902
push 0x55fac0
mov edx, dword [ebp - 0x18]
push edx
call fcn.004fa970
add esp, 8
test eax, eax
je 0x437902
push 0x55fac8
mov eax, dword [ebp - 0x18]
push eax
call fcn.004fa970
add esp, 8
test eax, eax
jne 0x437913
push 1
push 0x4376ac
call dword [sym.imp.user32.dll_EnumWindows]
xor eax, eax
jmp 0x437929
push 0
push 0x4376ac
call dword [sym.imp.user32.dll_EnumWindows]
xor eax, eax
jmp 0x437929
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x43b11e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x536612
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x808
mov dword [ebp - 0x814], ecx
lea ecx, [ebp - 0x804]
call fcn.0043e99e
mov dword [ebp - 4], 0
call fcn.004090a0
mov dword [eax + 0x3f4], 1
call fcn.004090a0
mov dword [eax + 0x3f8], 1
mov eax, dword [ebp - 0x814]
mov ecx, dword [eax + 0x1c]
add ecx, 0x24c
call fcn.00409600
push eax
push 0x571120
call fcn.004fa590
add esp, 8
mov ecx, dword [ebp - 0x814]
mov edx, dword [ebp - 0x814]
mov eax, dword [edx + 0x40c]
mov dword [ecx + 0x408], eax
push 0
push 0
push 1
push 0xcb
lea ecx, [ebp - 0x7fc]
call fcn.004057e0
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x7a0], ecx
lea ecx, [ebp - 0x7fc]
call fcn.00514883
call fcn.004090a0
mov dword [eax + 0x408], 0
call fcn.004090a0
mov dword [eax + 0x3f4], 0
call fcn.004090a0
cmp dword [eax + 0x3f8], 0
jne 0x43b2bf
call fcn.004090a0
cmp dword [eax + 0x3fc], 1
jne 0x43b2bf
mov edx, dword [ebp - 0x814]
cmp dword [edx + 0x360], 0
jne 0x43b2bf
push 0x571020
lea ecx, [ebp - 0x80c]
call fcn.00513d5b
mov byte [ebp - 4], 2
lea eax, [ebp - 0x80c]
push eax
call fcn.00425889
add esp, 4
push 0x571020
lea ecx, [ebp - 0x810]
call fcn.00513d5b
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x810]
push ecx
call fcn.0042581d
add esp, 4
push 1
lea ecx, [ebp - 0x80c]
call fcn.00409600
push eax
push 0
lea ecx, [ebp - 0x810]
call fcn.00409600
push eax
push 0
push 0
call dword [sym.imp.shell32.dll_ShellExecuteA]
mov dword [ebp - 0x808], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x810]
call fcn.00513ced
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x80c]
call fcn.00513ced
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x7fc]
call fcn.00405a84
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x804]
call fcn.0043ea1f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x43dd88
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x536848
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
mov dword [ebp - 0x21c], ecx
push 0x55fdf4
push 0
call fcn.004413c0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x43ddd4
push 0
push 0
push 0x55fe00
call fcn.0051c1dd
jmp 0x43de97
mov ecx, dword [ebp - 0x21c]
add ecx, 0xdc
call fcn.00409600
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.004fa590
add esp, 8
push 0x55fe14
lea ecx, [ebp - 0x118]
push ecx
call fcn.004fa5a0
add esp, 8
mov edx, dword [ebp - 0x21c]
add edx, 0xdc
push edx
lea ecx, [ebp - 0x18]
call fcn.00513a62
mov dword [ebp - 4], 0
push 1
lea ecx, [ebp - 0x18]
call fcn.00409600
push eax
push 0
lea eax, [ebp - 0x118]
push eax
push 0
push 0
call dword [sym.imp.shell32.dll_ShellExecuteA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x20
jle 0x43de5d
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00513ced
jmp 0x43de97
lea ecx, [ebp - 0x118]
push ecx
push 0x55fe24
lea edx, [ebp - 0x218]
push edx
call fcn.004fa9f4
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.0051c1dd
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00513ced
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x43e490
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5368aa
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x20], ecx
push 0x571020
lea ecx, [ebp - 0x14]
call fcn.00513d5b
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00409600
push eax
call dword [sym.imp.shlwapi.dll_PathFileExistsA]
test eax, eax
jne 0x43e4fc
push 0x55fea8
push 0x571020
call fcn.004fa0f6
add esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x43e4fc
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004fa00c
add esp, 4
lea ecx, [ebp - 0x14]
push ecx
call fcn.00425889
add esp, 4
push 0x571020
lea ecx, [ebp - 0x18]
call fcn.00513d5b
mov byte [ebp - 4], 1
lea edx, [ebp - 0x18]
push edx
call fcn.0042581d
add esp, 4
push 1
lea ecx, [ebp - 0x14]
call fcn.00409600
push eax
push 0
lea ecx, [ebp - 0x18]
call fcn.00409600
push eax
push 0
push 0
call dword [sym.imp.shell32.dll_ShellExecuteA]
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00513ced
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00513ced
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x43e57e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov dword [ebp - 0x114], ecx
lea eax, [ebp - 0x110]
push eax
push 0x20019
push 0
push 0x55feac
push 0x80000000
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x43e5dd
push 0
push 0
push 0x55fec4
call fcn.0051c1dd
mov ecx, dword [ebp - 0x114]
mov dword [ecx + 0x380], 0xffffffff
jmp 0x43e6fb
push 0x100
push 0
lea edx, [ebp - 0x104]
push edx
call fcn.004fa910
add esp, 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 0x108], 0x100
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x104]
push ecx
lea edx, [ebp - 4]
push edx
push 0
push 0
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 0x10c], eax
push 0x55fed4
lea ecx, [ebp - 0x104]
push ecx
call fcn.004fa970
add esp, 8
test eax, eax
jne 0x43e65a
mov edx, dword [ebp - 0x114]
mov dword [edx + 0x380], 1
jmp 0x43e6e8
push 0x55fee8
lea eax, [ebp - 0x104]
push eax
call fcn.004fa970
add esp, 8
test eax, eax
jne 0x43e684
mov ecx, dword [ebp - 0x114]
mov dword [ecx + 0x380], 0
jmp 0x43e6e8
push 0x55fefc
lea edx, [ebp - 0x104]
push edx
call fcn.004fa970
add esp, 8
test eax, eax
jne 0x43e6ae
mov eax, dword [ebp - 0x114]
mov dword [eax + 0x380], 2
jmp 0x43e6e8
push 0x55ff10
lea ecx, [ebp - 0x104]
push ecx
call fcn.004fa970
add esp, 8
test eax, eax
jne 0x43e6d8
mov edx, dword [ebp - 0x114]
mov dword [edx + 0x380], 3
jmp 0x43e6e8
mov eax, dword [ebp - 0x114]
mov dword [eax + 0x380], 0xffffffff
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [ebp - 0x10c], eax
mov esp, ebp
pop ebp
ret
Function at 0x43fdaf
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5369ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x124
mov dword [ebp - 0x12c], ecx
call fcn.004090a0
mov eax, dword [eax + 0x1c]
add eax, 0xa08
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
call fcn.00478db3
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jne 0x43fe05
jmp 0x43ff8b
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0
jmp 0x43fe2a
mov ecx, dword [ebp - 0x114]
add ecx, 1
mov dword [ebp - 0x114], ecx
mov edx, dword [ebp - 0x114]
cmp edx, dword [ebp - 0x11c]
jge 0x43ff7c
mov eax, dword [ebp - 0x114]
push eax
mov ecx, dword [ebp - 0x110]
call fcn.00478d94
mov dword [ebp - 0x118], eax
lea ecx, [ebp - 0x10c]
push ecx
mov ecx, dword [ebp - 0x118]
call fcn.004045b3
lea edx, [ebp - 0x10c]
push edx
lea ecx, [ebp - 0x124]
call fcn.00513d5b
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x124]
call fcn.0051419b
lea eax, [ebp - 0x124]
push eax
lea ecx, [ebp - 0x120]
call fcn.00513a62
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10c]
push ecx
mov edx, dword [ebp - 0x12c]
mov ecx, dword [edx + 0x1c]
add ecx, 0xbbc
call fcn.004299d3
test eax, eax
je 0x43ff11
mov eax, dword [ebp - 0x12c]
mov ecx, dword [eax + 0x1c]
call fcn.004748f0
lea ecx, [ebp - 0x10c]
push ecx
mov ecx, dword [ebp - 0x12c]
add ecx, 0x214
call fcn.00513e76
call fcn.004090a0
mov ecx, eax
add ecx, 0x214
call fcn.00409600
push eax
push 0x3e9
mov edx, dword [ebp - 0x12c]
mov ecx, dword [edx + 0x1c]
add ecx, 0xa08
call fcn.005131aa
lea ecx, [ebp - 0x120]
call fcn.00409600
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
push 0x55ffbc
lea ecx, [ebp - 0x120]
call fcn.00514055
push ecx
mov ecx, esp
mov dword [ebp - 0x128], esp
lea eax, [ebp - 0x120]
push eax
call fcn.00513a62
mov dword [ebp - 0x130], eax
call fcn.0043ff9b
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x120]
call fcn.00513ced
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x124]
call fcn.00513ced
jmp 0x43fe1b
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x110]
call fcn.004785ff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x43ff9b
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5369dd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00409600
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.004fa590
add esp, 8
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x210]
push edx
call fcn.004fa590
add esp, 8
lea eax, [ebp - 0x210]
push eax
call fcn.004fa680
add esp, 4
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
mov byte [ebp + ecx - 0x210], 0
mov edx, dword [ebp - 0x110]
mov byte [ebp + edx - 0x20f], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 3
lea eax, [ebp - 0x210]
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], 0
mov word [ebp - 0x220], 0x14
lea ecx, [ebp - 0x230]
push ecx
call dword [sym.imp.shell32.dll_SHFileOperation]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00513ced
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x444096
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x536e61
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x108
mov dword [ebp - 0x114], ecx
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x114]
call fcn.004410e0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004165f0
test eax, eax
je 0x4440ed
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00513ced
jmp 0x444135
lea ecx, [ebp - 0x10]
call fcn.00409600
push eax
lea ecx, [ebp - 0x110]
push ecx
call fcn.004fa590
add esp, 8
push 0x560178
lea edx, [ebp - 0x110]
push edx
call fcn.004fa5a0
add esp, 8
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00513ced
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x446321
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x536f6a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
call fcn.004554c0
test eax, eax
jne 0x446359
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x218], 0
jne 0x446359
jmp 0x4463d3
push 1
mov ecx, dword [ebp - 0x18]
call fcn.004437b0
test eax, eax
jne 0x446369
jmp 0x4463d3
mov ecx, dword [ebp - 0x18]
add ecx, 0x234
push ecx
lea ecx, [ebp - 0x10]
call fcn.00513a62
mov dword [ebp - 4], 0
push 0x5601c4
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x14]
push eax
call fcn.00513f82
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00409600
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
lea ecx, [ebp - 0x10]
call fcn.00409600
push eax
mov ecx, dword [ebp - 0x18]
call fcn.004433d8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00513ced
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00513ced
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x45cbbc
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.0045e250
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x45cc5c
push 0
mov ecx, dword [ebp - 4]
call fcn.0044f625
test eax, eax
je 0x45cc5c
mov ecx, dword [ebp - 4]
call fcn.0044f6b4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x45cc5c
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.kernel32.dll_GlobalLock]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0xc0]
call fcn.0045e8e9
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc0]
call fcn.0045e8fa
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x1c], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.kernel32.dll_GlobalUnlock]
mov ecx, dword [ebp - 0x10]
call fcn.0045e460
test eax, eax
je 0x45cc5c
call dword [sym.imp.user32.dll_EmptyClipboard]
mov eax, dword [ebp - 8]
push eax
push 8
call dword [sym.imp.user32.dll_SetClipboardData]
call dword [sym.imp.user32.dll_CloseClipboard]
mov esp, ebp
pop ebp
ret