joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453c00
Capabilities:
Create directory

Disassembly:
sub esp, 0x40
push esi
push edi
call fcn.0044adc0
add esp, 4
test eax, eax
jne 0x453c19
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, 1
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x2c], 9
mov dword [esp + 0x30], 0xb
mov dword [esp + 0x34], 0x69
mov dword [esp + 0x40], 0xffffffff
call fcn.005793fa
mov dword [esp + 8], eax
and eax, edx
add esp, 4
cmp eax, 0xffffffff
mov dword [esp + 8], edx
jne 0x453c70
push 0x80070057
call fcn.00401f90
lea esi, [esp + 0xc]
lea eax, [esp + 4]
call fcn.0043e660
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x28]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, edi
call fcn.0044a490
add esp, 0x10
neg eax
sbb eax, eax
neg eax
pop esi
add esp, 0x40
ret

Function at 0x453d10
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x6336a0]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
push edi
xor esi, esi
push esi
push 0x24
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x453d88
lea eax, [esp + 8]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x453d42
mov ecx, dword [str._temp]
mov edx, dword [0x5eaabc]
mov dword [eax], ecx
mov ecx, dword [0x5eaac0]
mov dword [eax + 4], edx
lea edi, [esp + 8]
mov dword [eax + 8], ecx
call fcn.00453c00
pop edi
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00577139
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.00577139
add esp, 0x214
ret

Function at 0x453db0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x218
mov eax, dword [0x6336a0]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
xor esi, esi
push esi
push 0x24
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x453e2a
lea eax, [esp + 8]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x453de1
mov ecx, dword [str._temp]
mov edx, dword [0x5eaabc]
mov dword [eax], ecx
mov ecx, dword [0x5eaac0]
mov dword [eax + 4], edx
lea edx, [esp + 8]
push edx
mov dword [eax + 8], ecx
call fcn.00453cc0
add esp, 4
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00577139
add esp, 0x218
ret
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00577139
add esp, 0x218
ret
Function at 0x454020
Capabilities:
Get common file path

Disassembly:
sub esp, 0x224
mov eax, dword [0x6336a0]
xor eax, esp
mov dword [esp + 0x21c], eax
push 0
push 0x24
lea eax, [esp + 0x18]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x454084
lea ecx, [esp]
push ecx
lea eax, [esp + 0x14]
call fcn.0044a4f0
add esp, 4
test eax, eax
jne 0x454084
push eax
push 4
push 0x5eaac4
call fcn.0055e834
mov eax, 1
mov ecx, dword [esp + 0x21c]
xor ecx, esp
call fcn.00577139
add esp, 0x224
ret
mov ecx, dword [esp + 0x21c]
xor ecx, esp
xor eax, eax
call fcn.00577139
add esp, 0x224
ret

Function at 0x454390
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x5acf18
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6336a0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov eax, str.keywords.txt
mov dword [esp + 0x1c], eax
mov dword [esp + 0x38], eax
xor eax, eax
xor ebx, ebx
cmp dword [esp + 0x58], eax
mov dword [esp + 0x20], str.lastopen.txt
sete al
mov dword [esp + 0x24], str._tango.ini
mov dword [esp + 0x28], str._tgfilter.txt
mov dword [esp + 0x2c], str._safesites.txt
mov dword [esp + 0x30], str.userurls.txt
mov dword [esp + 0x34], str._searcheng.txt
mov dword [esp + 0x3c], str._favorites3.txt
mov ebp, eax
lea esp, [esp]
mov esi, dword [esp + ebx*4 + 0x1c]
mov ecx, dword [esp + 0x54]
push esi
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.00401ba0
mov edi, eax
mov eax, dword [esp + 0x5c]
push esi
push eax
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x60], 0
call fcn.00401ba0
mov edi, dword [edi]
mov eax, dword [eax]
add esp, 0x18
push ebp
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x45446e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x48], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x454496
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add ebx, 1
cmp ebx, 9
jl 0x454410
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret
Function at 0x4545d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a4689
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
mov eax, dword [0x6336a0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], 0
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
je 0x4547aa
mov ecx, str.about:blank
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x454636
test dx, dx
je 0x454632
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x454636
add eax, 4
add ecx, 4
test dx, dx
jne 0x454610
xor eax, eax
jmp 0x45463b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4547aa
push 4
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.00414630
mov dword [esp + 0x28], 0
push 0x5ea930
mov ecx, eax
mov dword [esp + 0x14], 1
call fcn.004043e0
test eax, eax
je 0x454698
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jl 0x454698
push 0x5e50f8
push eax
call fcn.0057781d
add esp, 8
test eax, eax
je 0x454698
sub eax, dword [esi]
sar eax, 1
cmp eax, 2
jl 0x454698
mov bl, 1
jmp 0x45469a
xor bl, bl
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4546c2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x4546dd
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x20
ret
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
cmp ecx, 1
jge 0x4546f1
push 0x80070057
call fcn.00401f90
movzx edx, word [eax + 2]
cmp dx, 0x3a
jne 0x454712
mov eax, 2
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x20
ret
test ecx, ecx
jl 0x45472e
push 0x5e50f8
push eax
call fcn.0057781d
add esp, 8
test eax, eax
je 0x45472e
sub eax, dword [esi]
sar eax, 1
jns 0x45477a
push 0x5d839c
lea ecx, [esp + 0x1c]
call fcn.004023b0
push esi
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x34], 1
call fcn.00401ae0
add esp, 0xc
push eax
mov ecx, esi
mov byte [esp + 0x2c], 2
call fcn.00402310
lea ecx, [esp + 0x10]
call fcn.00401f20
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0xffffffff
call fcn.00401f20
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov esi, dword [esi]
lea edx, [esp + 0xc]
push edx
push eax
push ecx
lea edx, [esp + 0x28]
push edx
push esi
call fcn.00563bbb
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x20
ret
mov eax, 3
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x456840
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [sym.imp.WININET.dll_FindNextUrlCacheEntryW]
push esi
push edi
xor edi, edi
mov dword [esp + 0x14], edi
xor esi, esi
mov ebx, 0x1000
mov eax, 0x7a
nop
test eax, eax
je 0x4568a0
cmp eax, 0x7a
jne 0x4568f6
push esi
call fcn.0055517b
push ebx
call fcn.00555176
mov esi, eax
add esp, 8
test edi, edi
mov dword [esi], ebx
mov dword [esp + 0x10], ebx
jne 0x4568d3
lea eax, [esp + 0x10]
push eax
push esi
push edi
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryW]
mov edi, eax
xor eax, eax
test edi, edi
setne al
jmp 0x4568dc
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x4568b7
test dword [esi + 0xc], 0x100000
jne 0x4568cf
mov edx, dword [esi + 4]
push edx
jmp 0x4568c9
cmp eax, 1
jne 0x4568cf
test dword [esi + 0xc], 0x100000
je 0x4568cf
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
mov dword [esp + 0x10], ebx
lea ecx, [esp + 0x10]
push ecx
push esi
push edi
call ebp
test eax, eax
je 0x4568e7
xor eax, eax
jmp 0x456860
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [esp + 0x10]
jmp 0x456860
cmp eax, 0x103
jne 0x456905
mov dword [esp + 0x14], 1
push esi
call fcn.0055517b
add esp, 4
test edi, edi
je 0x456919
push edi
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4

Function at 0x456930
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [sym.imp.WININET.dll_FindNextUrlCacheEntryW]
push esi
push edi
xor edi, edi
xor esi, esi
mov ebx, 0x1000
mov eax, 0x7a
mov dword [esp + 0x14], edi
nop
test eax, eax
je 0x456990
cmp eax, 0x7a
push esi
jne 0x4569e4
call fcn.0055517b
push ebx
call fcn.00555176
mov esi, eax
add esp, 8
test edi, edi
mov dword [esi], ebx
mov dword [esp + 0x10], ebx
jne 0x4569c1
lea eax, [esp + 0x10]
push eax
push esi
push edi
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryW]
mov edi, eax
xor eax, eax
test edi, edi
setne al
jmp 0x4569ca
test dword [esi + 0xc], 0x100000
je 0x4569bd
mov edx, dword [esp + 0x1c]
mov eax, dword [esi + 4]
push edx
push eax
call fcn.0057781d
add esp, 8
test eax, eax
je 0x4569bd
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
add dword [esp + 0x14], 1
mov dword [esp + 0x10], ebx
lea ecx, [esp + 0x10]
push ecx
push esi
push edi
call ebp
test eax, eax
je 0x4569d5
xor eax, eax
jmp 0x456950
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [esp + 0x10]
jmp 0x456950
call fcn.0055517b
add esp, 4
test edi, edi
je 0x4569f7
push edi
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x456e20
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x6336a0]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push edi
push 0x11c
xor esi, esi
lea eax, [esp + 0xc]
push esi
push eax
call fcn.0057bb20
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x11c
call edi
test eax, eax
jne 0x456e8e
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x114
call edi
test eax, eax
jne 0x456e8e
pop edi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.00577139
add esp, 0x120
ret
cmp dword [esp + 0x18], 2
jne 0x456ea1
cmp dword [esp + 0xc], 5
jb 0x456ea1
mov esi, 1
mov ecx, dword [esp + 0x124]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.00577139
add esp, 0x120
ret

Function at 0x457300
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x14
push ebp
push esi
mov esi, dword [esp + 0x24]
xor ebp, ebp
cmp esi, ebp
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebp
je 0x45742c
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
mov edi, dword [esp + 0x28]
lea eax, [esp + 0x10]
push eax
push 0x40000
push ebp
push esi
push edi
call ebx
test eax, eax
jne 0x45741b
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x10]
push ecx
push 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test eax, eax
jne 0x45741b
cmp dword [esp + 0x34], ebp
je 0x457416
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push ebp
push esi
push edi
mov dword [esp + 0x24], ebp
call ebx
test eax, eax
jne 0x45741b
push eax
push eax
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x24]
push ebp
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x48]
push eax
push ebp
push ebp
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x45741b
push 0x20a
call fcn.00555176
xor edi, edi
add esp, 4
cmp dword [esp + 0x2c], edi
mov esi, eax
jbe 0x45740d
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edx, dword [esp + 0x10]
push 0x105
push esi
push edi
push edx
call ebx
test eax, eax
jne 0x4573fd
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x10]
push 1
push eax
push esi
push ecx
mov ecx, dword [esp + 0x24]
call fcn.00457300
jmp 0x457404
cmp eax, 0x103
je 0x45740d
add edi, 1
cmp edi, dword [esp + 0x2c]
jb 0x4573d3
push esi
call fcn.0055517b
add esp, 4
mov ebp, 1
mov eax, dword [esp + 0x10]
test eax, eax
pop edi
pop ebx
je 0x45742c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, ebp
pop ebp
add esp, 0x14
ret 0x10
Function at 0x457440
Capabilities:
Get file size
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5a061b
mov eax, dword fs:[0]
push eax
mov eax, 0x271c
call fcn.0057bc50
mov eax, dword [0x6336a0]
xor eax, esp
mov dword [esp + 0x2718], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6336a0]
xor eax, esp
push eax
lea eax, [esp + 0x2730]
mov dword fs:[0], eax
mov esi, ecx
mov edi, edx
call fcn.00555692
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x45749d
push 0x80004005
call fcn.00401f90
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
push 0x2710
lea ecx, [esp + 0x20]
push 0
push ecx
mov dword [esp + 0x2744], 0
call fcn.0057bb20
add esp, 0xc
test esi, esi
jne 0x4574d4
xor eax, eax
jmp 0x4574ef
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4574e0
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [esp + 0x1c]
call fcn.00402270
push 0x5c
lea ecx, [esp + 0x18]
call fcn.0044dbb0
test edi, edi
jne 0x45750d
xor eax, eax
jmp 0x457521
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x457512
sub eax, edx
sar eax, 1
push eax
push edi
lea ecx, [esp + 0x1c]
call fcn.004044f0
mov ebp, dword [esp + 0x14]
push 0
push 0x80
push 3
push 0
push 3
push 0x40000000
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x457579
mov dword [esp + 0x2738], eax
lea eax, [ebp - 0x10]
lea edx, [eax + 0xc]
or ecx, esi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x457572
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x457607
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0
push 0x40
mov edi, eax
push esi
sub edi, 0x40
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test edi, edi
jbe 0x4575d4
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, edi
cmp edi, 0x2710
push 0
jbe 0x4575c6
lea ecx, [esp + 0x1c]
push ecx
push 0x2710
lea edx, [esp + 0x28]
push edx
push esi
call ebx
sub edi, 0x2710
jne 0x4575a0
jmp 0x4575d4
lea eax, [esp + 0x1c]
push eax
push edi
lea ecx, [esp + 0x28]
push ecx
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x10]
mov dword [esp + 0x2738], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x457602
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x2730]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2718]
xor ecx, esp
call fcn.00577139
add esp, 0x2728
ret
Function at 0x457630
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5a989b
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x6336a0]
xor eax, esp
mov dword [esp + 0x210], eax
mov eax, dword [0x6336a0]
xor eax, esp
push eax
lea eax, [esp + 0x218]
mov dword fs:[0], eax
call fcn.005644f1
mov ecx, dword [eax + 4]
call fcn.0055ce7d
push 0
mov dword [esp + 0x224], 0
call fcn.00456840
push 0
push 0x20
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4576ab
push 0
push 0
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.00456a10
lea ecx, [esp + 0xb]
mov dword [esp + 0x220], 0xffffffff
call fcn.0041cb90
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00577139
add esp, 0x220
ret

Function at 0x4576f0
Capabilities:
Get common file path
Get program files directory

Disassembly:
sub esp, 0x214
mov eax, dword [0x6336a0]
xor eax, esp
mov dword [esp + 0x20c], eax
push 0
push 0
push 0x2a
push 0
call dword [sym.imp.WININET.dll_InternetSetOptionW]
push 1
call fcn.00456840
push 0
push 0x21
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x45773e
push 0
push 0
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.00456a10
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00577139
add esp, 0x214
ret
Function at 0x457a60
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5a985b
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x6336a0]
xor eax, esp
mov dword [esp + 0x20c], eax
mov eax, dword [0x6336a0]
xor eax, esp
push eax
lea eax, [esp + 0x214]
mov dword fs:[0], eax
call fcn.005644f1
mov ecx, dword [eax + 4]
call fcn.0055ce7d
lea eax, [esp + 8]
push eax
push 0x104
mov dword [esp + 0x224], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x457ad3
push 0
push 1
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.00456a10
lea ecx, [esp + 7]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0041cb90
mov ecx, dword [esp + 0x214]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00577139
add esp, 0x21c
ret

Function at 0x457b10
Capabilities:
Delete registry key
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x6336a0]
xor eax, esp
mov dword [esp + 0x208], eax
push 0
push 8
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x457b49
push 0
push 0
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.00456a10
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerRecentDocs
push closesocket
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00577139
add esp, 0x20c
ret

Function at 0x457bb0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x6336a0]
xor eax, esp
mov dword [esp + 0x208], eax
push 0
push 0x13
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x457be9
push 0
push 0
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.00456a10
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00577139
add esp, 0x20c
ret
Function at 0x457c00
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x5b1528
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6336a0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
call fcn.00555692
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x457c3e
push 0x80004005
call fcn.00401f90
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], 0
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov esi, 1
push esi
lea ecx, [esp + 0x14]
push str.Machine_d
push ecx
call fcn.00404650
mov edx, dword [esp + 0x1c]
add esp, 0xc
push edx
push str.SoftwareMicrosoftTelnet
push closesocket
call edi
push esi
lea eax, [esp + 0x14]
push str.Service_d
push eax
call fcn.00404650
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push ecx
push str.SoftwareMicrosoftTelnet
push closesocket
call edi
push esi
lea edx, [esp + 0x14]
push str.TermType_d
push edx
call fcn.00404650
mov ebx, dword [esp + 0x1c]
add esp, 0xc
push ebx
push str.SoftwareMicrosoftTelnet
push closesocket
call edi
add esi, 1
cmp esi, 8
jle 0x457c61
push str.LastMachine
push str.SoftwareMicrosoftTelnet
push closesocket
call edi
push str.LastService
push str.SoftwareMicrosoftTelnet
push closesocket
call edi
push str.LastTermType
push str.SoftwareMicrosoftTelnet
push closesocket
call edi
lea eax, [ebx - 0x10]
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x457d2c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x457d40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x218
mov eax, dword [0x6336a0]
xor eax, esp
mov dword [esp + 0x214], eax
lea eax, [esp + 4]
push eax
push 0x5d1f90
push 1
push 0
push str._J7_
mov dword [esp + 0x18], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x457d97
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x24]
push eax
call edx
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
push 0x104
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [esp + 8]
add eax, 0xfffffffe
mov edi, edi
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x457db0
mov ecx, dword [str.History]
mov edx, dword [0x5eb778]
mov dword [eax], ecx
mov ecx, dword [0x5eb77c]
mov dword [eax + 4], edx
mov edx, dword [0x5eb780]
mov dword [eax + 8], ecx
mov cx, word [0x5eb784]
push 1
mov dword [eax + 0xc], edx
push 0
lea edx, [esp + 0x10]
mov word [eax + 0x10], cx
push edx
mov ecx, esi
call fcn.00456a10
push 0
push 0x22
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x457e1f
push 1
push 0
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.00456a10
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.00577139
mov esp, ebp
pop ebp
ret
Function at 0x457e90
Capabilities:
Link many functions at runtime

Disassembly:
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.TGHistoryDllTest
push eax
mov dword [esi], eax
call edi
mov ecx, dword [esi]
push str.TGHistoryCreate
push ecx
mov dword [esi + 4], eax
call edi
mov edx, dword [esi]
push str.TGHistoryDelete
push edx
mov dword [esi + 8], eax
call edi
mov dword [esi + 0xc], eax
mov eax, dword [esi]
push str.TGHistoryCreateWnd
push eax
call edi
mov ecx, dword [esi]
push str.TGHistoryMoveWindow
push ecx
mov dword [esi + 0x10], eax
call edi
mov edx, dword [esi]
push str.TGHistorySetFillType
push edx
mov dword [esi + 0x20], eax
call edi
mov dword [esi + 0x14], eax
mov eax, dword [esi]
push str.TGHistorySetLineColor
push eax
call edi
mov ecx, dword [esi]
push str.TGHistorySearchKeywordChange
push ecx
mov dword [esi + 0x2c], eax
call edi
mov edx, dword [esi]
push str.TGHistorySetIconDir
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi]
push str.TGHistorySetCallBack
push eax
call edi
mov ecx, dword [esi]
push str.TGHistoryKillThread
push ecx
mov dword [esi + 0x28], eax
call edi
mov edx, dword [esi]
push str.TGHistoryPreTranslateMsg
push edx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x30], eax
mov eax, dword [esi]
push str.TGHistorySetAppName
push eax
call edi
cmp dword [esi], 0
mov dword [esi + 0x34], eax
pop edi
je 0x457f9f
cmp dword [esi + 4], 0
je 0x457f9f
cmp dword [esi + 8], 0
je 0x457f9f
cmp dword [esi + 0x10], 0
je 0x457f9f
cmp dword [esi + 0x14], 0
je 0x457f9f
cmp dword [esi + 0xc], 0
je 0x457f9f
cmp dword [esi + 0x28], 0
je 0x457f9f
cmp dword [esi + 0x18], 0
je 0x457f9f
cmp dword [esi + 0x1c], 0
je 0x457f9f
cmp dword [esi + 0x20], 0
je 0x457f9f
cmp dword [esi + 0x24], 0
je 0x457f9f
cmp dword [esi + 0x2c], 0
je 0x457f9f
cmp dword [esi + 0x30], 0
je 0x457f9f
test eax, eax
je 0x457f9f
mov eax, 1
ret
xor eax, eax
ret