joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4433d4
Capabilities:
Parse credit card information

Disassembly:
push 0x28
mov eax, 0x50de03
call fcn.004db767
mov ebx, ecx
mov edi, ebx
lea eax, [ebx - 0x154]
neg edi
sbb edi, edi
and edi, eax
cmp dword [ebx + 0x14], 0
je 0x443525
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
push 0xb0
push dword [edi + 0x14c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x2c]
jne 0x443521
mov al, byte [ebp + 8]
cbw
push eax
mov dword [ebp - 0x30], eax
call fcn.004e3cd2
pop ecx
test eax, eax
je 0x443521
movsx ecx, byte [ebp + 8]
movzx eax, word [ebx]
mov dword [ebp - 0x34], ecx
cmp eax, ecx
je 0x443525
call fcn.0040d33d
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040d16b
mov dword [ebp - 4], 1
lea eax, [ebp - 0x2c]
push eax
lea ecx, [edi + 4]
call fcn.00410cc2
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
push esi
call fcn.00404285
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebx + 0x14]
jae 0x4434f7
add ebx, 4
mov eax, ebx
cmp dword [ebx + 0x14], 8
jb 0x443496
mov eax, dword [ebx]
movzx eax, word [eax + ecx*2]
cmp eax, 0x3d
ja 0x4434c5
je 0x443503
sub eax, 0x23
je 0x4434b1
dec eax
sub eax, 1
je 0x4434b1
sub eax, 1
jmp 0x4434d7
push dword [ebp - 0x30]
call fcn.004e3cbf
pop ecx
test eax, eax
jne 0x443503
push 0x1056
jmp 0x4434ef
cmp eax, 0x3f
jb 0x4434d9
cmp eax, 0x40
jbe 0x443503
cmp eax, 0x5e
je 0x443503
cmp eax, 0x60
je 0x443503
cmp dword [ebx + 0x14], 8
jb 0x4434e1
mov ebx, dword [ebx]
movzx eax, word [ebx + ecx*2]
cmp dword [ebp - 0x34], eax
je 0x443503
push 0x1057
push ecx
mov ecx, edi
call fcn.0041c51a
push 0x10
call dword [sym.imp.USER32.dll_MessageBeep]
xor ebx, ebx
jmp 0x443505
mov bl, 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.0040569b
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.0040d645
mov al, bl
jmp 0x443527
mov al, 1
jmp 0x443527
xor al, al
call fcn.004db711
ret 4
Function at 0x453160
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x414]
sub esp, 0x414
push 0xffffffffffffffff
push 0x51086c
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x57c080]
xor eax, ebp
mov dword [ebp + 0x410], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x14], esi
lea eax, [ebp]
mov dword [ebp - 0x18], esi
push eax
xor ebx, ebx
push 0x104
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x4531ca
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 7
mov word [esi], ax
jmp 0x453213
cmp dword [edi + 0x14], 8
jb 0x4531d2
mov edi, dword [edi]
lea eax, [ebp + 0x208]
push eax
push ebx
push edi
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x4531f8
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 7
mov word [esi], ax
jmp 0x453213
lea eax, [ebp + 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp + 0x208]
mov ecx, esi
push eax
call fcn.00404285
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.004dab24
add ebp, 0x414
leave
ret

Function at 0x453242
Capabilities:
Get disk information

Disassembly:
push 0x20
mov eax, 0x51089c
call fcn.004db767
mov ebx, ecx
mov dword [ebp - 0x2c], ebx
push dword [ebx + 4]
push dword [ebx]
call fcn.004043d4
mov eax, dword [ebx]
mov dword [ebx + 4], eax
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov esi, eax
lea ecx, [ebp - 0x28]
push ebx
push esi
call fcn.004539e7
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x4532cf
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
mov edx, eax
cmovae ecx, dword [ebp - 0x28]
push esi
call fcn.00470e10
mov eax, dword [esi + 4]
sub eax, dword [esi]
pop ecx
push 0x18
cdq
pop ecx
idiv ecx
test eax, eax
setne bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040569b
mov al, bl
call fcn.004db711
ret
Function at 0x458636
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x204]
sub esp, 0x204
push 0xffffffffffffffff
push 0x511a7f
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x57c080]
xor eax, ebp
mov dword [ebp + 0x200], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebp + 0x20c]
xor eax, eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
mov eax, dword [ebx + 4]
or eax, 0x2001f
push eax
push ecx
push dword [ebx]
lea ecx, [ebp - 0x18]
call fcn.00441aba
jmp 0x4586a9
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x18]
call fcn.00458636
mov esi, eax
test esi, esi
jne 0x4586f3
lea eax, [ebp - 0x28]
mov dword [ebp - 0x1c], 0x100
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp]
push eax
push esi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x45869d
cmp dword [ebp - 0x18], esi
je 0x4586e4
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x18], esi
push dword [ebp - 0x20]
mov ecx, ebx
mov dword [ebp - 0x14], esi
call fcn.004587b8
mov esi, eax
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 0
je 0x45870a
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x18], 0
and dword [ebp - 0x14], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp + 0x200]
xor ecx, ebp
call fcn.004dab24
add ebp, 0x204
leave
ret 4
Function at 0x4590f4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x511b07
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x57c080]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x410]
mov eax, dword [ebp + 0x414]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x418]
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp], ebx
mov byte [ebp - 4], 1
push 0x60
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x45918f
push 2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp - 0x1c], eax
test esi, esi
jne 0x45918f
call fcn.0040c237
mov edi, eax
jmp 0x459278
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4591ac
call fcn.0040c237
jmp 0x45926b
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4591a2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x18], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x4591d9
mov edi, 0x8007000e
jmp 0x45926d
push 2
pop ecx
mov byte [ebp - 4], cl
mul ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
cmp edx, ebx
ja 0x4592b6
jb 0x4591fa
cmp eax, 0xffffffff
ja 0x4592b6
cmp eax, 0x400
jbe 0x45920c
push eax
lea ecx, [ebp]
call fcn.0045185c
jmp 0x459212
lea eax, [ebp + 4]
mov dword [ebp], eax
mov dword [ebp - 4], 1
jmp 0x459230
cmp dword [ebp], 0
je 0x4591cf
push edi
push dword [ebp]
push edi
push dword [ebp - 0x14]
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x4591a2
xor edx, edx
mov eax, dword [ebp]
mov word [eax + ecx*2], dx
push dword [ebp + 0x41c]
push dword [ebp]
lea ecx, [ebp - 0x24]
call fcn.00458fa8
mov edi, eax
test esi, esi
je 0x459278
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], bl
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x45928b
lea ecx, [ebp]
call fcn.00451853
or dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.004dab24
add ebp, 0x408
leave
ret 0x10
push 0x80070216
call fcn.0040d86a
int3
Function at 0x46e7e0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x506b40
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x57c080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
cmp esi, edi
je 0x46e890
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.0046d480
mov dword [ebp - 4], 0
mov ecx, eax
call fcn.0046e960
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x46e870
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x46e866
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46e954
push edx
push ecx
call fcn.004dab35
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
add esi, 0x18
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp esi, edi
jne 0x46e816
mov edi, dword [ebx + 4]
mov esi, dword [ebx]
push edi
push esi
call fcn.0046f000
mov eax, dword [ebx]
mov dword [ebx + 4], eax
mov esi, dword [ebx + 0x10]
mov edi, dword [ebx + 0xc]
cmp esi, edi
je 0x46e920
lea eax, [ebp - 0x28]
lea ecx, [esi - 0x18]
push eax
call fcn.0046d480
mov dword [ebp - 4], 1
cmp dword [eax + 0x14], 8
jb 0x46e8c1
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x46e905
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x46e8fb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46e954
push edx
push ecx
call fcn.004dab35
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
add esi, 0xffffffe8
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp esi, edi
jne 0x46e8a6
push dword [ebx + 0x10]
push dword [ebx + 0xc]
call fcn.0046f000
mov eax, dword [ebx + 0xc]
mov ecx, ebx
mov dword [ebx + 0x10], eax
call fcn.0046ec70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004dab24
mov esp, ebp
pop ebp
ret
call fcn.004e0bd6
int3
Function at 0x46e960
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5144b1
mov eax, dword fs:[0]
push eax
sub esp, 0x474
mov eax, dword [0x57c080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esi + 0x14]
mov edx, esi
cmp edi, 8
jb 0x46e99c
mov edx, dword [esi]
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x46e9b3
mov eax, edx
cmp word [eax], 0x2a
je 0x46e9dd
add eax, 2
sub ecx, 1
jne 0x46e9a5
cmp edi, 8
jb 0x46e9ba
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004dab24
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x46e9b3
sub eax, edx
sar eax, 1
cmp eax, 0xffffffff
je 0x46e9b3
lea ecx, [ebp - 0x478]
call fcn.0046eb00
mov dword [ebp - 4], 0
cmp dword [esi + 0x14], 8
jb 0x46ea04
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x478]
call fcn.00483570
test eax, eax
je 0x46eadb
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp dword [ebp - 0x18], 0
je 0x46ea64
mov eax, dword [ebp - 0x478]
shr eax, 4
and eax, 1
cmp word [ebp - 0x44c], 0x2e
jne 0x46ea60
test eax, eax
je 0x46ea64
mov cx, word [ebp - 0x44a]
test cx, cx
je 0x46eab9
cmp cx, 0x2e
jne 0x46ea60
cmp word [ebp - 0x448], 0
je 0x46eab9
test eax, eax
jne 0x46eab9
lea eax, [ebp - 0x47c]
push eax
lea ecx, [ebp - 0x478]
call fcn.004839b0
mov byte [ebp - 4], 1
push dword [ebp - 0x47c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 0
or eax, 0xffffffff
mov ecx, dword [ebp - 0x47c]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x46eab9
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, 0x534850
jne 0x46eaf2
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call edi
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x46eadb
cmp dword [ebp - 0x18], 0
je 0x46eadb
lea ecx, [ebp - 0x478]
push ecx
push eax
call ebx
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x46ea24
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x478]
call fcn.0046ebb0
jmp 0x46e9c1
mov ecx, edx
call esi
jmp 0x46eab9

Function at 0x46fae0
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x46fb0f
cmp dword [edi + 0x20], 8
lea ecx, [edi + 0xc]
jb 0x46faf5
mov ecx, dword [ecx]
mov eax, dword [edi + 0x40]
sub esp, 8
or eax, 0xf003f
push eax
sub esp, 8
push ecx
push dword [edi + 0x3c]
mov ecx, edi
call fcn.004580b2
mov esi, dword [esp + 0x14]
cmp dword [esi + 0x14], 8
jb 0x46fb1b
mov esi, dword [esi]
mov ebx, dword [esp + 0x10]
cmp dword [ebx + 0x14], 8
jb 0x46fb27
mov ebx, dword [ebx]
test esi, esi
jne 0x46fb3b
mov eax, 0xd
pop edi
test eax, eax
pop esi
sete al
pop ebx
ret 0xc
push esi
call fcn.004e0c26
add esp, 4
lea eax, [eax*2 + 2]
push eax
push esi
push 2
push 0
push ebx
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
test eax, eax
pop esi
sete al
pop ebx
ret 0xc
Function at 0x46fe70
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
mov edx, dword [esi]
test edx, edx
jne 0x46fea0
cmp dword [esi + 0x20], 8
lea ecx, [esi + 0xc]
jb 0x46fe84
mov ecx, dword [ecx]
mov eax, dword [esi + 0x40]
sub esp, 8
or eax, 0xf003f
push eax
sub esp, 8
push ecx
push dword [esi + 0x3c]
mov ecx, esi
call fcn.004580b2
mov edx, dword [esi]
mov ecx, dword [esp + 8]
pop esi
cmp dword [ecx + 0x14], 8
jb 0x46fead
mov ecx, dword [ecx]
mov eax, dword [esp + 8]
push 4
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 4
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
ret 8
Function at 0x475c40
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 8
lea eax, [esp]
mov dword [esp], ecx
push eax
push 0x475c70
mov dword [esp + 0xc], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 4]
add esp, 8
ret

Function at 0x476f60
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
lea ebp, [esp - 0x2b8]
sub esp, 0x2b8
push 0xffffffffffffffff
push 0x5152af
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x57c080]
xor eax, ebp
mov dword [ebp + 0x2b4], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x57f44c]
test eax, eax
jne 0x47709e
push 0x10
call fcn.004dab43
mov esi, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
lea eax, [ebp]
push 0x2b4
push 0
push eax
call fcn.004de980
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea eax, [ebp]
add esp, 0x10
push 0x4011
push 0x2b4
push eax
push 0x10
push 0x540798
call edi
push 0x4011
push 0x2b4
mov dword [esi], eax
lea eax, [ebp]
push eax
push 0x10
push str.C:FAKE_DIR_
call edi
mov eax, dword [ebp + 4]
push 0x4013
push 0x2b4
mov dword [esi + 4], eax
lea eax, [ebp]
push eax
push 0x10
push str.C:FAKE_DIR_
call edi
mov eax, dword [ebp + 4]
mov dword [esi + 8], eax
lea eax, [ebp - 0x10]
push eax
push 0x11
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x47706d
push 0x4009
push 0x2b4
lea eax, [ebp]
push eax
push 0
push dword [ebp - 0x10]
call edi
mov eax, dword [ebp + 4]
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x477074
mov eax, dword [ebp - 0x14]
push dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
jmp 0x477074
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x57f44c]
mov dword [0x57f44c], esi
test eax, eax
je 0x47709c
push 0x10
push eax
call fcn.004dab35
mov eax, dword [0x57f44c]
add esp, 8
jmp 0x47709e
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x2b4]
xor ecx, ebp
call fcn.004dab24
lea esp, [ebp + 0x2b8]
pop ebp
ret
Function at 0x4770c0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5152f0
mov eax, dword fs:[0]
push eax
sub esp, 0x2b8
mov eax, dword [0x57c080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov edx, 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 8]
sub edx, dword [eax - 4]
sub ecx, 0x104
or ecx, edx
jge 0x47711c
push 0x104
lea ecx, [ebp + 8]
call fcn.0040d70c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov eax, dword [ebp + 8]
push dword [eax - 8]
push eax
call fcn.004e3907
mov edx, eax
add esp, 8
test edx, edx
js 0x4771e1
mov ecx, dword [ebp + 8]
cmp edx, dword [ecx - 8]
jg 0x4771e1
mov dword [ecx - 0xc], edx
xor ecx, ecx
mov eax, dword [ebp + 8]
push 0x2b4
push ecx
mov word [eax + edx*2], cx
lea eax, [ebp - 0x2c4]
push eax
call fcn.004de980
add esp, 0xc
lea eax, [ebp - 0x2c4]
push 0x4013
push 0x2b4
push eax
push 0x10
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov edi, dword [ebp - 0x2c0]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4771c2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov esi, dword [eax + 4]
cmp eax, 0x534850
jne 0x4771eb
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004dab24
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.0040d86a
call esi
jmp 0x4771c2
Function at 0x479930
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x515808
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x57c080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
call fcn.0040d33d
mov ecx, eax
test ecx, ecx
je 0x479a7c
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, 0x534850
jne 0x479a86
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
lea edx, [ebp - 0x10]
mov ecx, esi
call fcn.00479aa0
mov esi, dword [ebp - 0x10]
or ecx, 0xffffffff
test al, al
jne 0x4799a7
xor bl, bl
jmp 0x479a23
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebx]
lea ecx, [esi - 0x10]
sub edi, 0x10
cmp ecx, edi
je 0x479a1e
cmp dword [edi + 0xc], 0
jl 0x479a13
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x479a13
call fcn.004070e1
mov dword [ebp - 0x14], eax
lea edx, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x479a09
mov edx, dword [edi]
push edi
mov ecx, dword [edx]
mov eax, dword [ecx + 4]
cmp ecx, 0x534850
jne 0x479a8d
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov dword [ebx], eax
jmp 0x479a1e
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov dword [ebx], eax
jmp 0x479a1e
push dword [esi - 0xc]
mov ecx, ebx
push esi
call fcn.0040d8ae
mov bl, 1
or ecx, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x479a68
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, 0x534850
jne 0x479a96
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040d86a
call edx
jmp 0x479982
mov ecx, edx
call eax
jmp 0x479a09
call edx
jmp 0x479a68
Function at 0x479aa0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x418
mov eax, dword [0x57c080]
xor eax, esp
mov dword [esp + 0x414], eax
push ebx
push esi
lea eax, [esp + 0x214]
mov ebx, edx
push eax
push 0x104
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x479c57
lea eax, [esp + 0xc]
push eax
push 0
push dword [esi]
lea eax, [esp + 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x479c57
push ebp
lea eax, [esp + 0x10]
push edi
push eax
call fcn.004e0c26
mov esi, dword [ebx]
mov edi, eax
add esp, 4
test edi, edi
jne 0x479b92
lea ecx, [esi - 0x10]
mov edi, dword [ecx]
cmp dword [ecx + 4], eax
je 0x479c3c
cmp dword [ecx + 0xc], eax
lea edx, [ecx + 0xc]
jge 0x479b3d
cmp dword [esi - 8], eax
jl 0x479c83
mov dword [esi - 0xc], eax
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax], cx
jmp 0x479c3c
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x479b6a
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, 0x534850
jne 0x479c70
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [edi]
cmp eax, 0x534850
jne 0x479c79
lock inc dword [edi + 0x14]
lea eax, [edi + 8]
add eax, 0x10
mov dword [ebx], eax
jmp 0x479c3c
add eax, 0x10
mov dword [ebx], eax
jmp 0x479c3c
mov eax, dword [esi - 0xc]
lea ebp, [esp + 0x14]
sub ebp, esi
mov dword [esp + 0x10], eax
sar ebp, 1
test edi, edi
js 0x479c83
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or ecx, eax
jge 0x479bc4
push edi
mov ecx, ebx
call fcn.0040d70c
mov esi, dword [ebx]
lea ecx, [edi + edi]
cmp ebp, dword [esp + 0x10]
ja 0x479c12
mov eax, dword [esi - 8]
lea edx, [esi + ebp*2]
test ecx, ecx
je 0x479c2a
test edx, edx
jne 0x479bed
call fcn.004e0d64
mov dword [eax], 0x16
call fcn.004e0bc6
jmp 0x479c27
add eax, eax
cmp eax, ecx
jae 0x479c05
call fcn.004e0d64
mov dword [eax], 0x22
call fcn.004e0bc6
jmp 0x479c27
push ecx
push edx
push esi
call fcn.004dc7c0
add esp, 0xc
jmp 0x479c27
mov edx, dword [esi - 8]
lea eax, [esp + 0x14]
push ecx
push eax
add edx, edx
mov ecx, esi
call fcn.0040d7e5
add esp, 8
lea ecx, [edi + edi]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x479c83
mov dword [eax - 0xc], edi
xor edx, edx
mov eax, dword [ebx]
mov word [ecx + eax], dx
pop edi
pop ebp
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.004dab24
add esp, 0x418
ret
mov ecx, dword [esp + 0x41c]
xor al, al
pop esi
pop ebx
xor ecx, esp
call fcn.004dab24
add esp, 0x418
ret
mov ecx, edx
call esi
jmp 0x479b6a
mov ecx, edi
call dword [eax + 0xc]
jmp 0x479b88
push 0x80070057
call fcn.0040d86a
int3