joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412980
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4e4260]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], ecx
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.0046f350
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp - 0x218]
call fcn.00412820
movzx edx, al
test edx, edx
jne 0x412a09
push 0
push 0x1a
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x210]
push ecx
call fcn.0046fb52
add esp, 4
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x412a09
jmp 0x412a7a
push 0x4c3374
lea edx, [ebp - 0x210]
push edx
call fcn.0046fcd6
add esp, 8
push 0x4c3378
lea eax, [ebp - 0x210]
push eax
call fcn.0046fcd6
add esp, 8
push 0x4c33a0
lea ecx, [ebp - 0x210]
push ecx
call fcn.0046fcd6
add esp, 8
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x412a65
lea eax, [ebp - 0x210]
push eax
call fcn.004131d0
add esp, 4
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp - 0x218]
add ecx, 0x24
call fcn.00403490
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046f960
mov esp, ebp
pop ebp
ret

Function at 0x412a90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x4e4260]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x62c], ecx
mov word [ebp - 0x420], 0
push 0x206
push 0
lea eax, [ebp - 0x41e]
push eax
call fcn.0046f350
add esp, 0xc
push 0x4c33a4
lea ecx, [ebp - 0x420]
push ecx
call fcn.0046fd00
add esp, 8
push 0x4c33b8
lea edx, [ebp - 0x420]
push edx
call fcn.0046fcd6
add esp, 8
mov ecx, dword [ebp - 0x62c]
add ecx, 0x40
call fcn.004017f0
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.0046fd00
add esp, 8
mov ecx, dword [ebp - 0x62c]
add ecx, 0x24
call fcn.004017f0
push eax
lea ecx, [ebp - 0x628]
push ecx
call fcn.0046fd00
add esp, 8
lea edx, [ebp - 4]
push edx
push 2
push 0
lea eax, [ebp - 0x420]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x412b93
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push 1
push 0
push 0x4c33d8
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x104
lea eax, [ebp - 0x628]
push eax
push 1
push 0
push 0x4c33f0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0046f960
mov esp, ebp
pop ebp
ret
Function at 0x4131d0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
push eax
call fcn.0046fb52
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 1
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044f370
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.0046fd00
add esp, 8
mov byte [ebp - 1], 1
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
jmp 0x41323a
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 8]
jg 0x4132a8
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax + edx*2]
cmp ecx, 0x5c
jne 0x4132a6
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov cx, word [eax + edx*2]
mov word [ebp - 0x18], cx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov word [eax + edx*2], 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41328f
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x41328f
mov byte [ebp - 1], 0
jmp 0x4132a8
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dx, word [ebp - 0x18]
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x413231
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.0044f36b
add esp, 4
movzx eax, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x415510
Capabilities:
Check if file exists
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x4e4260]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x415555
xor eax, eax
jmp 0x415654
mov word [ebp - 0x220], 0
push 0x206
push 0
lea ecx, [ebp - 0x21e]
push ecx
call fcn.0046f350
add esp, 0xc
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 4], 1
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0x4c37cc
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x415632
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov word [ebp - 0x428], 0
push 0x206
push 0
lea edx, [ebp - 0x426]
push edx
call fcn.0046f350
add esp, 0xc
push 0
push 0x26
lea eax, [ebp - 0x428]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.Internet_Exploreriexplore.exe
lea ecx, [ebp - 0x428]
push ecx
call fcn.0046fcd6
add esp, 8
lea edx, [ebp - 0x428]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x415618
xor eax, eax
jmp 0x415654
lea eax, [ebp - 0x428]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0046fd00
add esp, 8
mov eax, 1
jmp 0x415654
lea edx, [ebp - 0x220]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0046fd00
add esp, 8
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0046f960
mov esp, ebp
pop ebp
ret
Function at 0x415670
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x4e4260]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x23c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x228], 0
mov word [ebp - 0x448], 0
push 0x206
push 0
lea eax, [ebp - 0x446]
push eax
call fcn.0046f350
add esp, 0xc
mov word [ebp - 0x220], 0
push 0x206
push 0
lea ecx, [ebp - 0x21e]
push ecx
call fcn.0046f350
add esp, 0xc
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x44c], 1
lea edx, [ebp - 0x10]
push edx
push 0x20019
push 0
push 0x4c3810
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x415743
xor eax, eax
jmp 0x4158a0
lea eax, [ebp - 0x22c]
push eax
push 0x20019
push 0
push 0x4c381c
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x415776
xor eax, eax
jmp 0x4158a0
lea edx, [ebp - 0x234]
push edx
push 0x20019
push 0
push 0x4c3828
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x4157ac
xor eax, eax
jmp 0x4158a0
mov dword [ebp - 0x228], 0x104
mov dword [ebp - 8], 1
lea ecx, [ebp - 0x228]
push ecx
lea edx, [ebp - 0x448]
push edx
lea eax, [ebp - 8]
push eax
push 0
push 0x4c3844
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x448]
push ecx
call fcn.00471982
add esp, 4
mov dword [ebp - 0x224], eax
push 0x4c3848
mov edx, dword [ebp - 0x224]
push edx
call fcn.00405aa0
add esp, 8
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 0
jne 0x415839
xor eax, eax
jmp 0x4158a0
mov eax, dword [ebp - 0x450]
add eax, 2
mov dword [ebp - 0x224], eax
mov ecx, dword [ebp - 0x224]
mov dword [ebp - 0x238], ecx
push 0x4c384c
mov edx, dword [ebp - 0x224]
push edx
call fcn.00405aa0
add esp, 8
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 0
jne 0x41587b
xor eax, eax
jmp 0x4158a0
mov eax, dword [ebp - 0x450]
mov word [eax], 0
mov ecx, dword [ebp - 0x238]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41589b
xor eax, eax
jmp 0x4158a0
mov eax, 1
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0046f960
mov esp, ebp
pop ebp
ret
Function at 0x415a90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0x4e4260]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x238], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x228], 0
mov word [ebp - 0x440], 0
push 0x206
push 0
lea eax, [ebp - 0x43e]
push eax
call fcn.0046f350
add esp, 0xc
mov word [ebp - 0x220], 0
push 0x206
push 0
lea ecx, [ebp - 0x21e]
push ecx
call fcn.0046f350
add esp, 0xc
mov dword [ebp - 0x10], 0x104
mov dword [ebp - 0x444], 1
lea edx, [ebp - 0x14]
push edx
push 0x20019
push 0
push str.htmlfile
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x415b63
xor eax, eax
jmp 0x415c57
lea eax, [ebp - 0x22c]
push eax
push 0x20019
push 0
push str.shell
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x415b96
xor eax, eax
jmp 0x415c57
lea edx, [ebp - 0x234]
push edx
push 0x20019
push 0
push str.opencommand
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x415bcc
xor eax, eax
jmp 0x415c57
mov dword [ebp - 0x228], 0x104
mov dword [ebp - 0xc], 1
lea ecx, [ebp - 0x228]
push ecx
lea edx, [ebp - 0x440]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push 0x4c38d4
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x440]
push ecx
call fcn.00471982
add esp, 4
mov dword [ebp - 0x224], eax
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x224]
push eax
call fcn.00405aa0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x415c52
xor eax, eax
jmp 0x415c57
mov eax, 1
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0046f960
mov esp, ebp
pop ebp
ret
Function at 0x415db0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfe0
mov eax, dword [0x4e4260]
xor eax, ebp
mov dword [ebp - 0x40], eax
push 0x7d0
lea eax, [ebp - 0xfe0]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x4c3920
push 0x4c3980
call fcn.0046fb52
add esp, 4
lea ecx, [ebp + eax*2 - 0xfe0]
push ecx
call fcn.0046fd00
add esp, 8
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0xfe0]
push eax
call fcn.0046fcd6
add esp, 8
push 0x3c
push 0
lea ecx, [ebp - 0x3c]
push ecx
call fcn.0046f350
add esp, 0xc
mov dword [ebp - 0x30], 0x4c3988
mov dword [ebp - 0x38], 0x200
mov edx, dword [ebp + 8]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], 1
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x4c3994
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x415e60
lea ecx, [ebp - 0xfe0]
push ecx
call fcn.00415fe0
add esp, 4
mov ecx, dword [ebp - 0x40]
xor ecx, ebp
call fcn.0046f960
mov esp, ebp
pop ebp
ret

Function at 0x415f70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [ebp + 8]
push eax
call fcn.0046fb52
add esp, 4
test eax, eax
jne 0x415f88
jmp 0x415fdb
push 0x3c
push 0
lea ecx, [ebp - 0x3c]
push ecx
call fcn.0046f350
add esp, 0xc
mov dword [ebp - 0x30], 0x4c3a18
mov dword [ebp - 0x38], 0x200
mov edx, dword [ebp + 8]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], 1
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x415fdb
mov ecx, dword [ebp + 8]
push ecx
call fcn.00415fe0
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x415fe0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x4e4260]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x44
push 0
lea eax, [ebp - 0x830]
push eax
call fcn.0046f350
add esp, 0xc
mov dword [ebp - 0x830], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x7e8]
push ecx
call fcn.0046f350
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 0x4c3a30
lea eax, [ebp - 0x7d8]
push eax
call fcn.0046f4c8
add esp, 0xc
lea ecx, [ebp - 0x7e8]
push ecx
lea edx, [ebp - 0x830]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x7d8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x41606a
jmp 0x416084
mov ecx, dword [ebp - 0x7e8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x7e4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046f960
mov esp, ebp
pop ebp
ret
Function at 0x416260
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x660
mov eax, dword [0x4e4260]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jne 0x416280
xor eax, eax
jmp 0x4163d9
mov word [ebp - 0x218], 0
push 0x206
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.0046f350
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x218]
push edx
call fcn.0046fd00
add esp, 8
lea eax, [ebp - 0x218]
push eax
call fcn.00472b47
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x450], 0
push 0x228
push 0
lea ecx, [ebp - 0x44c]
push ecx
call fcn.0046f350
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0xffffffff
jne 0x416314
xor eax, eax
jmp 0x4163d9
mov dword [ebp - 0x450], 0x22c
lea edx, [ebp - 0x450]
push edx
mov eax, dword [ebp - 0x21c]
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4163ca
mov word [ebp - 0x660], 0
push 0x206
push 0
lea ecx, [ebp - 0x65e]
push ecx
call fcn.0046f350
add esp, 0xc
lea edx, [ebp - 0x42c]
push edx
lea eax, [ebp - 0x660]
push eax
call fcn.0046fd00
add esp, 8
lea ecx, [ebp - 0x660]
push ecx
call fcn.00472b47
add esp, 4
mov dword [ebp - 0x454], eax
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x454]
push eax
call fcn.004716c4
add esp, 8
test eax, eax
jne 0x4163af
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x448]
jmp 0x4163d9
lea edx, [ebp - 0x450]
push edx
mov eax, dword [ebp - 0x21c]
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x416339
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0046f960
mov esp, ebp
pop ebp
ret
Function at 0x416ac0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x416ae4
xor eax, eax
jmp 0x416b55
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0
mov edx, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x416b52
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push 0
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x417590
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4e4260]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, 1
test eax, eax
je 0x417621
mov word [ebp - 0x218], 0
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.0046f350
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4175f1
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41760c
jmp 0x417621
cmp dword [ebp - 8], 0xa
jl 0x417616
xor eax, eax
jmp 0x417626
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x4175b1
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0046f960
mov esp, ebp
pop ebp
ret
Function at 0x417a00
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4e4260]
xor eax, ebp
mov dword [ebp - 0x14], eax
push str..del
mov eax, dword [ebp + 8]
push eax
call fcn.00405aa0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x417a40
push 5
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x417b33
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov edx, 1
test edx, edx
je 0x417b25
mov dword [ebp - 0x10], 1
mov word [ebp - 0x220], 0
push 0x206
push 0
lea eax, [ebp - 0x21e]
push eax
call fcn.0046f350
add esp, 0xc
cmp dword [ebp - 0xc], 0
jne 0x417aa1
mov ecx, dword [ebp + 8]
push ecx
push str._s.del
lea edx, [ebp - 0x220]
push edx
call fcn.0046f4c8
add esp, 0xc
jmp 0x417abd
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._s.del_d
lea edx, [ebp - 0x220]
push edx
call fcn.0046f4c8
add esp, 0x10
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x417ade
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x417afa
cmp dword [ebp - 0xc], 0xa
jl 0x417aec
jmp 0x417b33
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
jmp 0x417a4e
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00472bb0
add esp, 8
push 5
push 0
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x417b33
push 5
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0046f960
mov esp, ebp
pop ebp
ret
Function at 0x417b50
Capabilities:
Check if file exists
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x4e4260]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x417b76
jmp 0x417d4f
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x417b8e
jmp 0x417d4f
mov word [ebp - 0x210], 0
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call fcn.0046f350
add esp, 0xc
mov word [ebp - 0x420], 0
push 0x206
push 0
lea eax, [ebp - 0x41e]
push eax
call fcn.0046f350
add esp, 0xc
lea ecx, [ebp - 0x420]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00416d70
add esp, 8
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x424], 0
mov ecx, 1
test ecx, ecx
je 0x417d4f
mov dword [ebp - 0x428], 1
mov word [ebp - 0x630], 0
push 0x206
push 0
lea edx, [ebp - 0x62e]
push edx
call fcn.0046f350
add esp, 0xc
cmp dword [ebp - 0x424], 0
jne 0x417c68
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x420]
push ecx
push str._s_s.del
lea edx, [ebp - 0x630]
push edx
call fcn.0046f4c8
add esp, 0x10
jmp 0x417c91
mov eax, dword [ebp - 0x424]
push eax
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x420]
push edx
push str._s_s.del_d
lea eax, [ebp - 0x630]
push eax
call fcn.0046f4c8
add esp, 0x14
lea ecx, [ebp - 0x630]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x417cb5
lea edx, [ebp - 0x630]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
jne 0x417ce0
cmp dword [ebp - 0x424], 0xa
jl 0x417ccc
jmp 0x417d4f
mov eax, dword [ebp - 0x424]
add eax, 1
mov dword [ebp - 0x424], eax
jmp 0x417c05
lea ecx, [ebp - 0x630]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00472bb0
add esp, 8
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x417d17
push 5
push 0
lea ecx, [ebp - 0x630]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x417d48
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x417d48
push str.WanNengWBIME.users
mov eax, dword [ebp + 8]
push eax
call fcn.0046fd4c
add esp, 8
test eax, eax
je 0x417d48
push 5
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x417d4f
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0046f960
mov esp, ebp
pop ebp
ret