joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403cd8
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xe8]
sub esp, 0x168
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp + 0xe4], eax
push esi
mov esi, dword [ebp + 0xf0]
cmp dword [esi], 0
jne 0x403d05
mov dword [esi], 0x114
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x403da9
push 0x3f
push eax
mov byte [ebp + 0xa4], al
lea eax, [ebp + 0xa5]
push eax
call fcn.00475410
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0xa4]
push eax
lea eax, [ebp - 0x7c]
push eax
push str.CurrentVersion
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x80], 0x40
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x403d88
movsx eax, byte [ebp + 0xa4]
sub eax, 0x30
mov dword [esi + 4], eax
lea eax, [ebp + 0xa6]
push eax
mov dword [esi + 0x10], 2
call fcn.00476b71
pop ecx
mov dword [esi + 8], eax
jmp 0x403da9
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, al
shr eax, 8
movzx eax, al
mov dword [esi + 8], eax
xor eax, eax
cmp ecx, 4
seta al
mov dword [esi + 4], ecx
inc eax
mov dword [esi + 0x10], eax
mov eax, dword [esi + 4]
cmp eax, 6
ja 0x403db9
jne 0x403e10
cmp dword [esi + 8], 2
jb 0x403e10
push 0x118
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.00475410
add esp, 0xc
push str.RtlGetVersion
push str.ntdll.dll
mov dword [ebp - 0x78], 0x11c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403e10
lea ecx, [ebp - 0x78]
push ecx
call eax
test eax, eax
jne 0x403e10
mov eax, dword [esi]
cmp eax, dword [ebp - 0x78]
jb 0x403e02
mov eax, dword [ebp - 0x78]
push eax
lea eax, [ebp - 0x78]
push eax
push esi
call fcn.00479950
add esp, 0xc
mov ecx, dword [ebp + 0xe4]
xor eax, eax
xor ecx, ebp
inc eax
pop esi
call fcn.0047548a
add ebp, 0xe8
leave
ret
Function at 0x405053
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0xc
mov eax, 0x4b10bc
call fcn.004764b0
mov esi, ecx
mov dword [ebp - 0x18], esi
mov ebx, 0x4f9e00
push ebx
lea ecx, [ebp - 0x10]
call fcn.0040293e
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
call fcn.004010d8
pop ecx
test eax, eax
jne 0x4050a4
push 0x4d32b8
call fcn.00404d2e
pop ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402963
xor eax, eax
call fcn.00476588
ret 8
mov edi, dword [ebp - 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call fcn.00404e09
test eax, eax
jne 0x4050c8
push str.UnpackToTempFolder_SaveToFile_Failed__
call fcn.00404d2e
pop ecx
lea ecx, [edi - 0x10]
jmp 0x405095
push ebx
lea ecx, [ebp - 0x14]
call fcn.0040293e
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 1
call fcn.004010d8
mov esi, dword [ebp - 0x14]
pop ecx
push esi
xor ebx, ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40510e
push esi
push str.UnpackToTempFolder_Create_Folder_Failed__Folder_:__s
call fcn.00404d2e
pop ecx
pop ecx
lea ecx, [esi - 0x10]
call fcn.00402963
jmp 0x4050c3
cmp dword [ebp + 0xc], ebx
je 0x40513a
push ebx
push esi
push edi
call fcn.004738da
add esp, 0xc
test eax, eax
jl 0x405104
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call fcn.00401df2
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ebx, ebx
inc ebx
jmp 0x405148
mov ecx, dword [ebp - 0x18]
push esi
push edi
call fcn.0040535e
test eax, eax
jne 0x405122
lea ecx, [esi - 0x10]
call fcn.00402963
lea ecx, [edi - 0x10]
call fcn.00402963
mov eax, ebx
jmp 0x40509c

Function at 0x40515f
Capabilities:
Delete file

Disassembly:
push 8
mov eax, 0x4b575e
call fcn.004764b0
mov esi, ecx
mov dword [ebp - 0x14], esi
push 0x4f9e00
lea ecx, [ebp - 0x10]
call fcn.0040293e
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
call fcn.004010d8
pop ecx
test eax, eax
jne 0x4051a4
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402963
xor eax, eax
call fcn.00476588
ret 8
mov edi, dword [ebp - 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call ebx
push edi
call fcn.00404e09
test eax, eax
jne 0x4051bf
lea ecx, [edi - 0x10]
jmp 0x405195
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00403c36
mov byte [ebp - 4], 1
mov esi, dword [ebp + 8]
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
cmp dword [ebp + 0xc], 0
je 0x4051fa
push 0
push esi
push edi
call fcn.004738da
add esp, 0xc
test eax, eax
jge 0x405221
lea ecx, [esi - 0x10]
call fcn.00402963
jmp 0x4051ba
mov ecx, dword [ebp - 0x14]
push esi
push edi
call fcn.0040535e
test eax, eax
jne 0x405221
xor ebx, ebx
lea ecx, [esi - 0x10]
call fcn.00402963
lea ecx, [edi - 0x10]
call fcn.00402963
mov eax, ebx
jmp 0x40519c
push edi
call ebx
xor ebx, ebx
inc ebx
jmp 0x40520a
Function at 0x405403
Capabilities:
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0x1b8]
sub esp, 0x238
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp + 0x1b4], eax
mov eax, dword [ebp + 0x1c0]
and dword [ebp - 0x7c], 0
push edi
push 0
push 2
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x78], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x405498
lea eax, [ebp - 0x78]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x405491
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
push ebx
lea eax, [ebp - 0x54]
push eax
call esi
test eax, eax
je 0x405489
cmp dword [ebp + 0x1c4], 0
jne 0x405479
push dword [ebp - 0x80]
lea eax, [ebp - 0x54]
push eax
call esi
test eax, eax
je 0x405489
lea eax, [ebp - 0x78]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x405458
jmp 0x405490
mov dword [ebp - 0x7c], 1
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x1b4]
mov eax, dword [ebp - 0x7c]
xor ecx, ebp
pop edi
call fcn.0047548a
add ebp, 0x1b8
leave
ret
Function at 0x40563d
Capabilities:
Enumerate files on windows

Disassembly:
push 0x1d8
mov eax, 0x4b4b75
call fcn.00476519
mov eax, dword [ebp + 8]
xor ebx, ebx
push eax
mov esi, ecx
mov dword [ebp - 0x1c8], eax
mov dword [ebp - 0x1ac], ebx
call fcn.00476880
pop ecx
lea ecx, [ebp - 0x1c4]
mov dword [ebp - 0x1cc], eax
call fcn.0040a6d2
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.0040a68e
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x1c4]
mov byte [ebp - 4], 1
call fcn.0040a711
xor edi, edi
inc edi
jmp 0x405845
cmp dword [ebp - 0x1ac], ebx
jne 0x40586c
lea eax, [ebp - 0x1c4]
push eax
push dword [ebp - 0x1b8]
lea ecx, [ebp - 0x1dc]
call fcn.0040ad18
lea ecx, [ebp - 0x1dc]
call fcn.0040ad4a
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040b77b
lea eax, [ebp - 0x1c4]
push eax
mov byte [ebp - 4], 2
push dword [ebp - 0x1b8]
lea ecx, [ebp - 0x1d4]
call fcn.0040ad18
mov esi, dword [ebp - 0x1d0]
push dword [ebp - 0x1b4]
lea ecx, [esi + 0x1c]
mov eax, esi
call fcn.0040af1c
mov eax, dword [ebp - 0x1b4]
pop ecx
lea edx, [ebp - 0x1bc]
push edx
lea ecx, [eax - 0x1c]
push eax
push ecx
call fcn.0040af5a
sub dword [ebp - 0x1b4], 0x1c
add esp, 0xc
lea eax, [ebp - 0x1c4]
push eax
push esi
lea ecx, [ebp - 0x1e4]
call fcn.0040ad18
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x48]
call fcn.0040b77b
push str..
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 3
call fcn.0040a796
cmp dword [ebp - 0x30], 0x10
mov eax, dword [ebp - 0x44]
jae 0x405766
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x1a8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40583b
test byte [ebp - 0x1a8], 0x10
je 0x4057f5
cmp byte [ebp - 0x17c], 0x2e
jne 0x4057aa
cmp byte [ebp - 0x17b], bl
je 0x405816
cmp byte [ebp - 0x17b], 0x2e
jne 0x4057aa
cmp byte [ebp - 0x17a], bl
je 0x405816
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x64]
call fcn.0040b77b
push 0x4d33dc
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 4
call fcn.0040a796
lea eax, [ebp - 0x17c]
push eax
lea ecx, [ebp - 0x64]
call fcn.0040a796
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x1c4]
call fcn.0040a711
push ebx
push edi
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 3
call fcn.0040b7d9
jmp 0x405816
mov eax, dword [ebp - 0x1cc]
dec eax
push eax
push dword [ebp - 0x1c8]
lea eax, [ebp - 0x17c]
push eax
call fcn.00490d95
add esp, 0xc
test eax, eax
je 0x40582e
lea eax, [ebp - 0x1a8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40577f
jmp 0x405834
mov dword [ebp - 0x1ac], edi
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
push edi
lea ecx, [ebp - 0x48]
call fcn.0040b7d9
push ebx
push edi
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.0040b7d9
mov eax, dword [ebp - 0x1b4]
sub eax, dword [ebp - 0x1b8]
push 0x1c
cdq
pop ecx
idiv ecx
test eax, eax
jne 0x40569e
lea ecx, [ebp - 0x1c4]
call fcn.0040a8ab
push dword [ebp - 0x1c4]
call fcn.00472af9
mov eax, dword [ebp - 0x1ac]
pop ecx
call fcn.0047659c
ret
Function at 0x412909
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4e2dd8
push 0x476f70
mov eax, dword fs:[0]
push eax
push ecx
push ecx
mov eax, 0x2a18
call fcn.00476b30
mov eax, dword [0x4f3bd0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xa30], ebx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xa2c], eax
xor edi, edi
cmp eax, edi
je 0x412a62
push eax
call fcn.00475eae
pop ecx
cmp eax, 0x104
ja 0x412a62
mov dword [ebp - 4], edi
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
mov dword [ebp - 4], 0xfffffffe
jmp 0x41299e
mov esi, 0x800
push esi
push edi
lea eax, [ebp - 0xa24]
push eax
call fcn.00475410
mov dword [ebp - 0xa28], edi
push 0x2000
push edi
lea eax, [ebp - 0x2a30]
push eax
call fcn.00475410
add esp, 0x18
lea eax, [ebp - 0xa28]
push eax
push esi
lea eax, [ebp - 0x2a30]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x412a62
push 0x104
push dword [ebp - 0xa2c]
lea eax, [ebp - 0x224]
push eax
call fcn.004753b9
lea eax, [ebp - 0x224]
push eax
call fcn.004759b6
add esp, 0x10
cmp dword [ebp - 0xa28], edi
jbe 0x412a62
lea esi, [ebp + edi*4 - 0x2a30]
lea eax, [ebp - 0xa24]
push eax
push dword [esi]
call fcn.00412e3e
test eax, eax
je 0x412a59
lea eax, [ebp - 0xa24]
push eax
call fcn.004759b6
lea eax, [ebp - 0xa24]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.0047557e
add esp, 0xc
test eax, eax
jne 0x412a59
mov eax, dword [ebx]
push dword [esi]
push ebx
call dword [eax + 0x1c]
inc edi
cmp edi, dword [ebp - 0xa28]
jb 0x412a12
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0047548a
leave
ret 8

Function at 0x412dad
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 4]
push eax
push 0x28
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x412e08
lea eax, [ebp - 0x10]
push eax
push str.SeDebugPrivilege
push esi
mov dword [ebp - 0x14], 1
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push esi
push esi
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
leave
ret 4
Function at 0x413950
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
xor eax, eax
push esi
mov esi, dword [ebp + 0xc]
test ebx, ebx
je 0x4139b2
mov word [ebx], ax
test esi, esi
jne 0x413979
xor eax, eax
jmp 0x4139b2
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x413975
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.00475410
lea eax, [ebp - 0x68]
push eax
push esi
call fcn.0040d2f0
add esp, 0x14
test eax, eax
je 0x413975
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebp + 0x14]
call fcn.0040d39f
xor eax, eax
pop ecx
inc eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0047548a
leave
ret 0x10

Function at 0x4139fa
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x413a1b
xor eax, eax
jmp 0x413a6b
push esi
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
xor esi, esi
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
test eax, eax
jne 0x413a17
push 0x80020003
push 0x12
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
leave
ret 4
Function at 0x414421
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4d53c8]
mov dword [ebp - 0xc], eax
mov eax, dword [0x4d53cc]
mov dword [ebp - 8], eax
mov ax, word [ebp + 0xc]
mov word [ebp - 0xc], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x41445e
xor eax, eax
xor edx, edx
jmp 0x41448a
push 8
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00475410
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push 0
push 0
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x414458
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047548a
leave
ret 8

Function at 0x4145c6
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x810
mov eax, dword [0x4f3bd0]
xor eax, esp
mov dword [esp + 0x80c], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0x800
lea eax, [esp + 0x14]
push 0
push eax
call fcn.00475410
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov eax, dword [ebp + 0xc]
push 0
cdq
push 0x100000
push edx
push eax
lea esi, [esp + 0x20]
call fcn.0047ed40
cmp word [esp + 0x10], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
je 0x414658
movzx ecx, word [esi]
mov eax, dword [edi]
push ecx
push edi
call dword [eax + 0x50]
cmp edx, dword [esp + 0xc]
ja 0x414670
jb 0x414647
cmp eax, dword [esp + 8]
ja 0x414670
push esi
call fcn.00475eae
lea esi, [esi + eax*2 + 2]
cmp word [esi], 0
pop ecx
jne 0x41462f
xor eax, eax
mov ecx, dword [esp + 0x814]
pop edi
pop esi
xor ecx, esp
call fcn.0047548a
mov esp, ebp
pop ebp
ret 8
mov ax, word [esi]
jmp 0x41465a

Function at 0x414675
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x808
mov eax, dword [0x4f3bd0]
xor eax, esp
mov dword [esp + 0x804], eax
push 0x800
lea eax, [esp + 4]
push 0
push eax
call fcn.00475410
add esp, 0xc
push 0x400
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, dword [esp + 0x804]
mov ax, word [esp]
xor ecx, esp
call fcn.0047548a
mov esp, ebp
pop ebp
ret 4

Function at 0x414d81
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0x808
lea eax, [ebp - 0x80c]
push 0
push eax
call fcn.00475410
add esp, 0xc
push 1
push 0x1a
lea eax, [ebp - 0x80c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.360Safe_
lea eax, [ebp - 0x80c]
push eax
call esi
push 0
lea eax, [ebp - 0x80c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.360safe.setup.log
lea eax, [ebp - 0x80c]
push eax
call esi
lea eax, [ebp - 0x80c]
push eax
mov ecx, edi
call fcn.00402894
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
inc eax
pop esi
call fcn.0047548a
leave
ret 8
Function at 0x415c02
Capabilities:
Check if file exists

Disassembly:
push 4
mov eax, 0x4b5bfa
call fcn.004764b0
mov esi, ecx
mov dword [ebp - 0x10], esi
lea edi, [esi + 8]
mov dword [esi], vtable.CFileManagerEx.0
mov dword [esi + 4], vtable.CFileManagerEx.1.0
mov dword [edi], vtable.CFileManagerEx.2.0
push 1
push esi
mov dword [ebp - 4], 3
call fcn.00415d84
push dword [0x4fbd68]
mov eax, dword [esi + 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsPrefixW]
test eax, eax
jne 0x415c71
push dword [esi + 0x80]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x415c71
push esi
call fcn.0041612d
push dword [esi + 0x80]
call fcn.00402bad
pop ecx
lea eax, [esi + 0x84]
push eax
mov byte [ebp - 4], 2
call fcn.004162ec
mov ecx, dword [esi + 0x80]
sub ecx, 0x10
call fcn.00402963
mov dword [esi + 0x64], vtable._BaseModule::CCriticalSection.0
add esi, 0x68
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, edi
call fcn.004231f1
call fcn.00476588
ret

Function at 0x418459
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push 8
mov eax, 0x4b3f4b
call fcn.004764b0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x418487
and al, 0x10
xor cl, cl
cmp cl, al
sbb eax, eax
neg eax
je 0x418487
xor eax, eax
call fcn.00476588
ret
push dword [ebp + 8]
lea eax, [ebp - 0x14]
call fcn.0041819d
xor edi, edi
mov dword [ebp - 4], edi
mov esi, dword [ebp - 0x14]
push esi
call fcn.00475eae
cmp eax, 1
pop ecx
jle 0x4184b5
lea eax, [esi + eax*2 - 2]
cmp word [eax], 0x5c
jne 0x4184b5
xor ecx, ecx
mov word [eax], cx
push 0x5c
push esi
call fcn.004750f0
pop ecx
pop ecx
cmp eax, edi
jne 0x4184d1
push 0xf
pop edi
push esi
call fcn.00476b24
pop ecx
mov eax, edi
jmp 0x418481
xor ecx, ecx
push esi
mov word [eax], cx
call fcn.00418459
pop ecx
cmp eax, edi
je 0x4184e5
mov edi, eax
jmp 0x4184c6
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4184c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4184e1
jmp 0x4184c6
Function at 0x43de38
Capabilities:
Create process on windows
Initialize iwebbrowser2

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4ddf28
push 0x476f70
mov eax, dword fs:[0]
push eax
push ecx
push ecx
mov eax, 0x102c
call fcn.00476b30
mov eax, dword [0x4f3bd0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, dword [ebp + 8]
xor eax, eax
mov word [ebp - 0x101c], ax
push 0xffe
xor esi, esi
push esi
lea eax, [ebp - 0x101a]
push eax
call fcn.00475410
push ebx
push str.__s_
push 0x1000
lea eax, [ebp - 0x101c]
push eax
call fcn.00404703
add esp, 0x1c
push 5
push esi
lea eax, [ebp - 0x101c]
push eax
push 0x4bb210
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x43ded9
xor eax, eax
inc eax
jmp 0x43dfce
mov dword [ebp - 4], esi
mov dword [ebp - 0x1020], esi
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x1020]
push eax
push 0x4c7988
push 0x15
push esi
push 0x4c7998
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x43dfbf
mov eax, dword [ebp - 0x1020]
cmp eax, esi
je 0x43dfa6
mov ecx, dword [eax]
lea edx, [ebp - 0x1024]
push edx
push eax
call dword [ecx + 0x94]
mov edi, dword [ebp - 0x1024]
cmp edi, esi
je 0x43df43
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 3
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
call fcn.00475eae
pop ecx
test eax, eax
jbe 0x43df9a
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x103c], eax
xor eax, eax
mov word [ebp - 0x1034], ax
push 8
pop eax
mov word [ebp - 0x1044], ax
mov eax, dword [ebp - 0x1020]
mov ecx, dword [eax]
lea edx, [ebp - 0x1034]
push edx
push edx
push edx
push edx
lea edx, [ebp - 0x1044]
push edx
push eax
call dword [ecx + 0xd0]
push dword [ebp - 0x103c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x1020]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 4], 0xfffffffe
jmp 0x43ded1
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0047548a
leave
ret
Function at 0x4434c6
Capabilities:
Get disk information via ioctl

Disassembly:
push 0x14
mov eax, 0x4b31f7
call fcn.004764b0
push str.._
lea ecx, [ebp - 0x10]
call fcn.0040260e
push dword [ebp + 8]
xor esi, esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.0043bdcf
push 0x3a
lea ecx, [ebp - 0x10]
call fcn.0043bdcf
push esi
push esi
push 3
push esi
push 3
push 0xc0000000
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x44352a
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402963
xor eax, eax
call fcn.00476588
ret 8
push esi
lea eax, [ebp - 0x14]
push eax
push 0xc
lea eax, [ebp - 0x20]
push eax
push esi
push esi
push 0x2d1080
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push edi
test eax, eax
jne 0x44355d
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402963
mov eax, esi
jmp 0x443522
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
cmp eax, esi
je 0x44356f
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
xor esi, esi
inc esi
jmp 0x44354e

Function at 0x44377b
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x4f3bd0]
xor eax, ebp
mov dword [ebp + 0x18c], eax
push esi
mov esi, dword [ebp + 0x198]
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
mov edi, ecx
call fcn.00475410
and dword [ebp - 0x80], 0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x7c]
mov ecx, edi
call fcn.004434c6
test eax, eax
je 0x4437e6
test esi, esi
je 0x4437e6
mov ecx, dword [ebp - 0x80]
mov dword [esi], ecx
mov ecx, dword [ebp + 0x18c]
pop edi
xor ecx, ebp
pop esi
call fcn.0047548a
add ebp, 0x190
leave
ret 4

Function at 0x44498a
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x444997
xor eax, eax
pop esi
ret
push 1
push 1
push dword [esi + 0x10]
call fcn.004021cb
test eax, eax
je 0x444993
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop esi
ret
Function at 0x445199
Capabilities:
Check if file exists

Disassembly:
push 4
mov eax, 0x4b51c9
call fcn.004764b0
lea eax, [ebp - 0x10]
push eax
call fcn.00444e24
and dword [ebp - 4], 0
push str.SuperKiller.exe
lea ecx, [ebp - 0x10]
call fcn.00403af2
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4451ff
push dword [ebp - 0x10]
call fcn.00401e3f
pop ecx
test eax, eax
je 0x4451ff
push 0
xor esi, esi
inc esi
push esi
push esi
push dword [ebp - 0x10]
call fcn.00401f29
test eax, eax
je 0x4451ff
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402963
mov eax, esi
call fcn.00476588
ret
xor esi, esi
jmp 0x4451ec