joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b999
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
mov eax, dword [0x52ec00]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0x294], 0xffffffff
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x290], ax
lea eax, [ebp - 0x28e]
push eax
mov esi, ecx
call fcn.004dbcc0
add esp, 0xc
lea eax, [ebp - 0x290]
push eax
call fcn.0044bbed
test eax, eax
jne 0x44b9ee
or eax, 0xffffffff
jmp 0x44bbde
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44bbd8
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edi, eax
push str.iexplore.exe
push edi
call fcn.004d5d48
pop ecx
pop ecx
test eax, eax
jne 0x44ba32
mov dword [ebp - 0x294], 1
jmp 0x44bbd8
push str.360se.exe
push edi
call fcn.004d5d48
pop ecx
pop ecx
test eax, eax
jne 0x44bb0c
push 2
mov eax, esi
call fcn.0044b931
mov edi, eax
push 3
mov eax, esi
call fcn.0044b931
mov ebx, eax
push 4
mov eax, esi
call fcn.0044b931
test edi, edi
je 0x44bae2
test ebx, ebx
jne 0x44ba72
test eax, eax
je 0x44bad3
xor eax, eax
push 0x7e
push eax
mov word [ebp - 0x88], ax
lea eax, [ebp - 0x86]
push eax
call fcn.004dbcc0
add esp, 0xc
push 0x3f
pop ebx
lea esi, [ebp - 0x88]
lea edi, [ebp - 0x290]
call fcn.00436f88
test eax, eax
je 0x44bbd8
push 0x36
pop eax
cmp ax, word [ebp - 0x88]
je 0x44bad3
push 0x35
pop eax
cmp ax, word [ebp - 0x88]
je 0x44bae6
push 0x34
pop eax
cmp ax, word [ebp - 0x88]
jne 0x44bbd8
jmp 0x44bafd
mov dword [ebp - 0x294], 2
jmp 0x44bbd8
test ebx, ebx
je 0x44baf5
mov dword [ebp - 0x294], 3
jmp 0x44bbd8
test eax, eax
je 0x44bbd8
mov dword [ebp - 0x294], 4
jmp 0x44bbd8
push str.SogouExplorer.exe
push edi
call fcn.004d5d48
pop ecx
pop ecx
test eax, eax
jne 0x44bb2c
mov dword [ebp - 0x294], 6
jmp 0x44bbd8
push str.360chrome.exe
push edi
call fcn.004d5d48
pop ecx
pop ecx
test eax, eax
jne 0x44bb4c
mov dword [ebp - 0x294], 5
jmp 0x44bbd8
push str.chrome.exe
push edi
call fcn.004d5d48
pop ecx
pop ecx
test eax, eax
jne 0x44bb69
mov dword [ebp - 0x294], 9
jmp 0x44bbd8
push str.liebao.exe
push edi
call fcn.004d5d48
pop ecx
pop ecx
test eax, eax
jne 0x44bb86
mov dword [ebp - 0x294], 7
jmp 0x44bbd8
push str.QQBrowser.exe
push edi
call fcn.004d5d48
pop ecx
pop ecx
test eax, eax
jne 0x44bbbd
push 0xa
pop edi
push edi
mov eax, esi
call fcn.0044b931
test eax, eax
jne 0x44bbb5
push 0xb
pop edi
push edi
mov eax, esi
call fcn.0044b931
test eax, eax
je 0x44bbd8
mov dword [ebp - 0x294], edi
jmp 0x44bbd8
push str.baidubrowser.exe
push edi
call fcn.004d5d48
pop ecx
pop ecx
test eax, eax
jne 0x44bbd8
mov dword [ebp - 0x294], 8
mov eax, dword [ebp - 0x294]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d5a7d
leave
ret
Function at 0x44bbed
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x634]
sub esp, 0x6b4
mov eax, dword [0x52ec00]
xor eax, ebp
mov dword [ebp + 0x630], eax
mov eax, dword [ebp + 0x63c]
push ebx
push esi
push edi
mov dword [ebp - 0x80], eax
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp + 0x3a8], ax
lea eax, [ebp + 0x3aa]
push ebx
push eax
mov dword [ebp - 0x70], ebx
call fcn.004dbcc0
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0xc
cmp dword [0x548460], ebx
je 0x44bcaf
push 0x7e
pop edi
xor eax, eax
push edi
mov word [ebp + 0x5b0], ax
lea eax, [ebp + 0x5b2]
push ebx
push eax
call fcn.004dbcc0
add esp, 0xc
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x5b0]
push eax
lea eax, [ebp - 0x78]
push eax
push str.Progid
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
push 0x80000001
mov dword [ebp - 0x78], 1
mov dword [ebp - 0x6c], edi
call esi
test eax, eax
jne 0x44bcc5
lea eax, [ebp + 0x5b0]
push eax
push str._s_shellopencommand
lea eax, [ebp + 0x3a8]
push 0xffffffffffffffff
push eax
call fcn.0044c905
add esp, 0x10
jmp 0x44bcc5
push str.http_shellopencommand
lea eax, [ebp + 0x3a8]
push 0xffffffffffffffff
push eax
call fcn.0044c905
add esp, 0xc
xor eax, eax
mov edi, 0x40e
push edi
mov word [ebp - 0x68], ax
lea eax, [ebp - 0x66]
push ebx
push eax
call fcn.004dbcc0
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
lea eax, [ebp + 0x3a8]
push eax
push 0x80000000
mov dword [ebp - 0x74], 1
mov dword [ebp - 0x7c], edi
call esi
test eax, eax
jne 0x44bd4a
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x6c], ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
cmp esi, ebx
je 0x44bd4a
cmp dword [ebp - 0x6c], ebx
je 0x44bd43
push dword [esi]
push 0x50e498
push 0xffffffffffffffff
push 0x104
push dword [ebp - 0x80]
call fcn.004d78c1
add esp, 0x14
mov dword [ebp - 0x70], 1
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp + 0x630]
mov eax, dword [ebp - 0x70]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d5a7d
add ebp, 0x634
leave
ret 4
Function at 0x44d03b
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x52ec00]
xor eax, ebp
mov dword [ebp + 0x190], eax
push esi
mov esi, ecx
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44d10c
push ebx
push str.PropFindOwner
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetPropW]
xor ebx, ebx
mov dword [ebp - 0x80], eax
cmp eax, ebx
je 0x44d10b
xor eax, eax
push 0x208
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push ebx
push eax
call fcn.004dbcc0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x7c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea esi, [edi + 0xd8]
cmp word [ebp - 0x7c], bx
je 0x44d0ef
lea eax, [ebp - 0x7c]
push eax
push esi
call fcn.0044d183
test eax, eax
je 0x44d10b
lea eax, [ebp - 0x7c]
push eax
push esi
call fcn.00406723
push dword [esi]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [edi + 4]
push ebx
push 0x6406
push dword [ebp - 0x80]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x44d10b
mov eax, dword [esi]
cmp dword [eax - 0xc], ebx
je 0x44d106
push ebx
push ebx
push 0x6405
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
call fcn.0040664d
pop ebx
mov ecx, dword [ebp + 0x190]
xor ecx, ebp
or eax, 0xffffffff
pop esi
call fcn.004d5a7d
add ebp, 0x194
leave
ret

Function at 0x44e442
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
xor edi, edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp + 8], eax
je 0x44e478
push dword [ebp + 8]
push edi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp eax, edi
jne 0x44e478
xor eax, eax
jmp 0x44e51b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0xc], edi
je 0x44e50d
push esi
push edi
push edi
push edi
push 0xf001f
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
cmp esi, edi
je 0x44e50c
mov eax, dword [esi]
cmp eax, 0x29
je 0x44e4bd
cmp eax, 0x54
jne 0x44e500
mov eax, esi
mov ecx, 0x549b94
call fcn.0040f893
mov dword [ebp - 8], eax
jmp 0x44e500
push edi
call dword [sym.imp.USER32.dll_InSendMessageEx]
and al, 9
cmp al, 1
jne 0x44e4d1
push edi
call dword [sym.imp.USER32.dll_ReplyMessage]
push 0x1388
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp + 8]
push eax
push edi
push dword [esi + 8]
mov dword [ebp + 8], edi
push 0x44e6f6
push edi
push edi
call fcn.004d67c7
add esp, 0x18
cmp eax, edi
je 0x44e500
push eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp + 0xc]
call ebx
pop esi
cmp dword [ebp - 4], edi
je 0x44e517
push dword [ebp - 4]
call ebx
mov eax, dword [ebp - 8]
pop ebx
pop edi
leave
ret 8
Function at 0x44ef42
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x12c0
call fcn.004e84e0
mov eax, dword [0x52ec00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x125c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1278], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x1c]
mov dword [ebp - 0x1274], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x1260], eax
xor eax, eax
push 0x124e
mov word [ebp - 0x1258], ax
xor edi, edi
lea eax, [ebp - 0x1256]
push edi
push eax
and esi, 0x20
call fcn.004dbcc0
xor eax, eax
add esp, 0xc
inc eax
test byte [ebp + 0x1c], 2
je 0x44efb1
push 5
pop eax
movzx cx, byte [ebx + 0x10]
movzx edx, byte [ebx + 0xc]
shl cx, 8
movzx ecx, cx
or ecx, edx
push ecx
push str.__set
push dword [ebp + 0x1c]
push str.__flag
push dword [ebp + 0x18]
push str.__type
push eax
push str.__class
push dword [ebp - 0x1274]
lea eax, [ebp - 0x1258]
push str.__param
push dword [ebp - 0x1278]
push str.__msgwnd
push dword [ebp - 0x125c]
push str.__parent
push dword [0x5473c8]
push str.__hostwnd
push 0x549bac
push 0x518c38
push 0x927
push eax
call fcn.004d5add
push 0x40
lea eax, [ebp - 0x12bc]
push edi
push eax
call fcn.004dbcc0
xor eax, eax
mov dword [ebp - 0x1270], edi
add esp, 0x5c
lea edi, [ebp - 0x126c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x1270]
push eax
lea eax, [ebp - 0x12c0]
push eax
xor edi, edi
push edi
push edi
mov eax, esi
neg eax
sbb eax, eax
and eax, 0x40
push eax
push 1
push edi
push edi
lea eax, [ebp - 0x1258]
push eax
push edi
mov dword [ebp - 0x12c0], 0x44
mov dword [ebp - 0x1294], 0x80
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x125c], eax
cmp eax, edi
je 0x44f0af
cmp dword [ebp - 0x126c], edi
je 0x44f0af
push dword [ebp - 0x126c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x126c], edi
cmp dword [ebp + 0x18], 1
jne 0x44f0e6
xor eax, eax
cmp esi, edi
sete al
mov dword [ebx + 0x430], eax
mov eax, dword [ebp - 0x1270]
mov dword [ebx + 0x424], eax
mov eax, dword [ebp - 0x1268]
mov dword [ebx + 0x428], eax
mov eax, dword [ebp - 0x1264]
mov dword [ebx + 0x42c], eax
cmp dword [ebp - 0x1260], edi
je 0x44f0fe
mov edi, dword [ebp - 0x1260]
lea esi, [ebp - 0x1270]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x125c]
pop edi
xor ecx, ebp
pop esi
call fcn.004d5a7d
leave
ret 0x18
Function at 0x44f67c
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push 8
mov eax, 0x4f7b72
call fcn.004de80b
mov eax, dword [ebp + 8]
call fcn.00426b5f
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x44f77e
push 0xd
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x44f778
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x44f76f
cmp word [eax], 0
mov ebx, eax
je 0x44f76f
cmp word [eax], 0
je 0x44f733
movzx ecx, word [ebx]
cmp cx, 0xd
je 0x44f6eb
cmp cx, 0xa
jne 0x44f72b
cmp ebx, eax
jbe 0x44f728
mov edi, ebx
sub edi, eax
sar edi, 1
push eax
mov ecx, 0x545cc4
lea esi, [ebp - 0x10]
call fcn.00405c7a
and dword [ebp - 4], 0
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
je 0x44f71c
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
call fcn.00421cc0
or dword [ebp - 4], 0xffffffff
lea eax, [esi - 0x10]
call fcn.00406ace
lea eax, [ebx + 2]
inc ebx
inc ebx
cmp word [ebx], 0
jne 0x44f6d6
cmp ebx, eax
jbe 0x44f76f
mov edi, ebx
sub edi, eax
sar edi, 1
push eax
mov ecx, 0x545cc4
lea esi, [ebp - 0x10]
call fcn.00405c7a
mov dword [ebp - 4], 1
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
je 0x44f767
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
call fcn.00421cc0
lea eax, [esi - 0x10]
call fcn.00406ace
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
call fcn.004de8e3
ret
Function at 0x451089
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x10
mov eax, 0x4fa12e
call fcn.004de80b
mov eax, dword [0x545cc4]
mov esi, 0x545cc4
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [0x545cc4]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
mov byte [ebp - 4], 1
push dword [ebp + 0x10]
lea ebx, [ebp - 0x14]
push 0x54a7dc
mov dword [ebp - 0x14], edi
call fcn.004083dd
test eax, eax
je 0x45115f
cmp dword [ebp - 0x14], edi
jne 0x45115f
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
lea eax, [ebp + 0x10]
mov ecx, esi
mov dword [ebp + 0x10], edi
call fcn.00454929
push dword [ebp + 0x10]
lea ebx, [esi + 0x700]
mov eax, ebx
call fcn.004867c4
cmp eax, edi
je 0x451117
cmp dword [eax + 0x30], 0xffffffff
jne 0x451135
mov ecx, dword [ebp - 0x10]
push 1
push edi
push edi
push edi
push edi
call fcn.00416bfd
mov ecx, dword [ebp - 0x10]
add esp, 0x10
push eax
push dword [ebp + 0x10]
push ebx
call fcn.00486703
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, dword [ebp - 0x10]
add esi, 0xcc4
shr eax, 8
movzx eax, al
mov ecx, eax
or ecx, dword [ebp + 0x18]
or eax, dword [ebp + 0x14]
push ecx
push eax
push esi
push 3
pop ecx
call fcn.00450013
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00406ace
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00406ace
call fcn.004de8e3
ret 0x14
Function at 0x45210d
Capabilities:
Copy file
Delete file
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x648
mov eax, dword [0x52ec00]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x634], eax
mov eax, dword [ebp + 0xc]
push 0xa
mov dword [ebp - 0x628], eax
call fcn.00431f47
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x41c], ax
xor esi, esi
lea eax, [ebp - 0x41a]
push esi
push eax
call fcn.004dbcc0
add esp, 0xc
xor eax, eax
push edi
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push esi
push eax
call fcn.004dbcc0
mov eax, dword [ebp - 0x628]
add esp, 0xc
push esi
push 2
lea ecx, [ebp - 0x638]
push ecx
lea ecx, [ebp - 0x41c]
add eax, 0x5d558
push ecx
mov ebx, 0x103
push eax
mov dword [ebp - 0x638], ebx
call dword [sym.imp.SHLWAPI.dll_UrlGetPartW]
test eax, eax
jl 0x4522d0
xor eax, eax
cmp ax, word [ebp - 0x41c]
je 0x4522d0
push edi
mov word [ebp - 0x624], ax
lea eax, [ebp - 0x622]
push esi
push eax
call fcn.004dbcc0
add esp, 0xc
lea edi, [ebp - 0x624]
call fcn.004027c3
lea eax, [ebp - 0x41c]
push eax
mov eax, edi
push eax
push str._s_s.ico
lea eax, [ebp - 0x214]
push ebx
push eax
call fcn.004d5add
add esp, 0x14
lea ebx, [ebp - 0x214]
call fcn.004371a4
mov edi, dword [ebp - 0x628]
push esi
mov eax, ebx
push eax
add edi, 0x5d148
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push esi
push 0x80
push 4
push esi
push 2
push 0x40000000
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x452278
lea eax, [ebp - 0x648]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x648]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push esi
push esi
lea eax, [ebp - 0x630]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x628]
cmp dword [ebx + 0x5d120], 7
jne 0x4522d6
lea eax, [ebp - 0x62c]
push eax
push edi
mov dword [ebp - 0x62c], esi
call fcn.00419366
pop ecx
pop ecx
cmp dword [ebp - 0x62c], esi
jne 0x4522c2
push 1
lea eax, [ebp - 0x62c]
push eax
push esi
push esi
push edi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x4522d6
cmp dword [ebp - 0x62c], esi
je 0x4522d6
push dword [ebp - 0x62c]
call dword [sym.imp.USER32.dll_DestroyIcon]
jmp 0x4522d6
mov ebx, dword [ebp - 0x628]
mov eax, dword [ebp + 0x10]
call fcn.004468f4
cmp eax, esi
je 0x452334
lea ecx, [eax + 0x438c]
lea edx, [ebx + 0x5d558]
mov di, word [edx]
cmp di, word [ecx]
jne 0x452314
cmp di, si
je 0x452310
mov di, word [edx + 2]
cmp di, word [ecx + 2]
jne 0x452314
add edx, 4
add ecx, 4
cmp di, si
jne 0x4522ee
xor ecx, ecx
jmp 0x452319
sbb ecx, ecx
sbb ecx, 0xffffffff
cmp ecx, esi
jne 0x452334
mov esi, dword [ebp - 0x634]
add esi, 0xcc4
call fcn.00450799
mov ebx, dword [ebp - 0x628]
lea eax, [ebx + 0x5d148]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004d5a7d
leave
ret 0xc
Function at 0x45a97f
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetRectEmpty]
push dword [0x553070]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x45a9b2
push eax
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [0x553070], eax
mov eax, dword [0x553070]
xor esi, esi
cmp eax, esi
je 0x45aa83
push esi
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
cmp eax, esi
jne 0x45a9f3
xor eax, eax
mov dword [ebp - 0x10], esi
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push dword [0x553070]
call dword [sym.imp.USER32.dll_GetClientRect]
push esi
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_MonitorFromRect]
cmp eax, dword [ebp + 8]
jne 0x45aa83
mov esi, dword [sym.imp.SHELL32.dll_SHAppBarMessage]
push 0x24
pop edi
lea eax, [ebp - 0x34]
push eax
push 4
mov dword [ebp - 0x34], edi
call esi
xor ebx, ebx
inc ebx
test bl, al
je 0x45aa83
mov eax, dword [0x553070]
and dword [ebp - 0x28], 0
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x34]
push eax
push 7
mov dword [ebp - 0x34], edi
pop edi
push edi
call esi
test eax, eax
je 0x45aa3b
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
jmp 0x45aa83
lea eax, [ebp - 0x34]
push eax
push edi
mov dword [ebp - 0x28], ebx
call esi
test eax, eax
je 0x45aa51
mov eax, dword [ebp + 0xc]
mov dword [eax + 4], ebx
jmp 0x45aa83
lea eax, [ebp - 0x34]
push eax
push edi
mov dword [ebp - 0x28], 2
call esi
test eax, eax
je 0x45aa6b
mov eax, dword [ebp + 0xc]
mov dword [eax + 8], ebx
jmp 0x45aa83
lea eax, [ebp - 0x34]
push eax
push edi
mov dword [ebp - 0x28], 3
call esi
test eax, eax
je 0x45aa83
mov eax, dword [ebp + 0xc]
mov dword [eax + 0xc], ebx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x45c490
Capabilities:
Check if file exists

Disassembly:
push 8
mov eax, 0x4f8663
call fcn.004de80b
mov edi, ecx
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45c52a
push dword [ebp + 8]
lea esi, [edi + 8]
call fcn.004314bb
push ebx
mov eax, esi
call fcn.004314f7
test eax, eax
je 0x45c527
mov eax, dword [edi]
lea ecx, [ebp - 0x10]
push ecx
mov ecx, edi
call dword [eax + 0x14]
mov dword [ebp - 4], ebx
push dword [ebp - 0x10]
push esi
call fcn.004315c1
mov edi, eax
cmp edi, ebx
je 0x45c515
push edi
call fcn.00431612
test eax, eax
je 0x45c50f
lea eax, [ebp + 8]
push eax
push ebx
push edi
mov dword [ebp + 8], ebx
call fcn.00431643
test eax, eax
je 0x45c50f
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ebp - 0x14], 1
push edi
call fcn.0043162f
mov eax, esi
call fcn.0043155a
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00406ace
mov eax, dword [ebp - 0x14]
call fcn.004de8e3
ret 8

Function at 0x45c532
Capabilities:
Check if file exists

Disassembly:
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 4], ebx
je 0x45c585
push dword [esp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45c585
push esi
push dword [esp + 0x10]
lea esi, [edi + 8]
call fcn.004314bb
push ebx
mov eax, esi
call fcn.004314f7
test eax, eax
je 0x45c580
push dword [esp + 0x14]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xc]
push eax
mov ecx, edi
call fcn.0045c58c
mov ebx, eax
mov eax, esi
call fcn.0043155a
mov eax, ebx
pop esi
jmp 0x45c587
xor eax, eax
pop edi
pop ebx
ret 8
Function at 0x45cce4
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
sub esp, 0x20c
lea ebp, [esp - 4]
mov eax, dword [0x52ec00]
xor eax, ebp
mov dword [ebp + 0x20c], eax
push 0xc
mov eax, 0x4f8ee1
call fcn.004de80b
mov eax, dword [ebp + 0x218]
mov ebx, ecx
push ebx
mov dword [ebp - 0x14], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x45cd25
xor eax, eax
jmp 0x45cdcb
xor eax, eax
push 0x208
push eax
mov word [ebp], ax
lea eax, [ebp + 2]
push eax
call fcn.004dbcc0
add esp, 0xc
lea eax, [ebp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.dh_tmp_sg.bak
lea eax, [ebp]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004195b5
mov esi, eax
and dword [ebp - 4], 0
push ebx
lea eax, [ebp - 0x18]
push eax
call fcn.004195b5
mov esi, dword [esi]
mov eax, dword [eax]
push esi
push eax
call fcn.004633b4
mov ebx, eax
mov eax, dword [ebp - 0x18]
neg ebx
pop ecx
sbb bl, bl
pop ecx
add eax, 0xfffffff0
inc bl
call fcn.00406ace
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00406ace
test bl, bl
jne 0x45cd1e
push dword [ebp - 0x14]
lea eax, [ebp]
push eax
mov ecx, edi
call fcn.0045c490
mov esi, eax
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.004d5a7d
add ebp, 0x210
leave
ret 4

Function at 0x45f418
Capabilities:
Read file on windows

Disassembly:
push ebp
push esi
push edi
push 0x511454
push dword [esp + 0x14]
call fcn.004d91d4
pop ecx
pop ecx
mov edi, eax
xor esi, esi
push 3
pop ebp
cmp edi, esi
jne 0x45f43d
mov eax, ebp
jmp 0x45f4dc
push ebx
push 2
push esi
push edi
call fcn.004d92c8
push edi
call fcn.004d94ea
push esi
push esi
push edi
mov ebx, eax
call fcn.004d92c8
add esp, 0x1c
cmp ebx, esi
jle 0x45f4d2
lea ebp, [ebx + 2]
push ebp
call fcn.004d60c3
mov esi, eax
pop ecx
test esi, esi
jne 0x45f473
push 3
pop eax
jmp 0x45f4db
push ebp
push 0
push esi
call fcn.004dbcc0
push edi
push 1
push ebx
push esi
call fcn.004d97f8
movzx ax, byte [esi + 1]
movzx cx, byte [esi]
shl ax, 8
or ax, cx
movzx ebp, ax
mov eax, 0xbbef
add esp, 0x1c
cmp bp, ax
jne 0x45f4ac
cmp byte [esi + 2], 0xbf
je 0x45f4b7
push ebx
push esi
call fcn.0045f3ca
test eax, eax
je 0x45f4bc
push 2
pop ebp
jmp 0x45f4cb
xor ecx, ecx
mov eax, 0xfeff
cmp bp, ax
sete cl
mov ebp, ecx
push esi
call fcn.004d618d
pop ecx
push edi
call fcn.004d9a70
pop ecx
mov eax, ebp
pop ebx
pop edi
pop esi
pop ebp
ret 4