joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c230
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52c2d0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x583bb4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x54
call fcn.0049a5c9
mov ecx, dword [ebp + 8]
mov esi, eax
lea edx, [esi + 4]
mov dword [ebp - 0x14], esi
add esp, 4
mov dword [ebp - 4], 0
lea edi, [edx + 4]
mov dword [ebp - 0x18], edx
mov dword [esi], 0x548134
lea ebx, [ecx + 4]
mov eax, dword [ecx]
mov ecx, edi
push ebx
mov dword [edx], eax
mov dword [ebp + 8], edi
call fcn.00431300
lea eax, [ebx + 0x18]
mov byte [ebp - 4], 1
lea ecx, [edi + 0x18]
push eax
mov dword [ebp - 0x18], ecx
call fcn.00431300
lea eax, [ebx + 0x30]
mov byte [ebp - 4], 2
lea ecx, [edi + 0x30]
push eax
mov dword [ebp - 0x18], ecx
call fcn.00431300
mov eax, dword [ebx + 0x48]
mov dword [edi + 0x48], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44d540
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52c518
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x583bb4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 1
lea eax, [ebp - 0x10]
xor bl, bl
push 0x540960
push eax
call fcn.004b9580
add esp, 0xc
mov edx, dword [eax]
mov ecx, edx
mov dword [ebp - 4], 0
lea esi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44d590
sub ecx, esi
lea esi, [edi + 0x14]
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.00436a80
mov edx, dword [ebp - 0x10]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44d5cd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [esi + 0x14], 8
jb 0x44d5d5
mov esi, dword [esi]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44d60b
cmp dword [edi + 0x10], 0
jne 0x44d5f7
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x10], eax
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44f090
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52c7c1
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x583bb4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, dword [ebp + 0xc]
mov ecx, edi
push str.HKEY_LOCAL_MACHINE
call fcn.004518d0
test eax, eax
jne 0x44f0dd
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x44f121
push str.HKEY_CURRENT_USER
mov ecx, edi
call fcn.004518d0
test eax, eax
jne 0x44f0f4
mov ebx, SysReAllocString
jmp 0x44f121
push 0x540394
mov ecx, edi
call fcn.004518d0
test eax, eax
jne 0x44f10b
mov ebx, SysReAllocString
jmp 0x44f121
push str.HKEY_USERS
mov ecx, edi
call fcn.004518d0
test eax, eax
mov ecx, VariantInit
cmove ebx, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x44f12b
mov eax, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x44f133
mov edi, dword [edi]
push eax
push edi
push 0x546fa8
call fcn.00446390
add esp, 0xc
test ebx, ebx
jne 0x44f14d
xor al, al
jmp 0x44f2a3
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004d1a10
add esp, 0xc
mov dword [ebp - 0x230], 1
cmp dword [esi + 0x14], 8
mov eax, esi
mov dword [ebp - 0x22c], 0x208
jb 0x44f181
mov eax, dword [esi]
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040df50
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.004b8c70
add esp, 8
mov edx, dword [ebp - 0x21c]
or edi, 0xffffffff
mov byte [ebp - 4], 2
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44f1ce
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [esi + 0x14], 8
jb 0x44f1d6
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x220]
call fcn.0040df50
push 0
lea eax, [ebp - 0x220]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.004b8b60
mov edx, dword [ebp - 0x220]
add esp, 0xc
mov byte [ebp - 4], 2
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44f21f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x224]
push dword [ebp - 0x228]
push ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x44f260
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44f260
mov bl, 1
jmp 0x44f262
xor bl, bl
mov edx, dword [ebp - 0x224]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44f27f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x228]
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x44f2a1
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049a028
mov esp, ebp
pop ebp
ret
Function at 0x4548b0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x583bb4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov edi, ecx
push 0
push eax
call fcn.004d1a10
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [edi + 0x58]
call dword [sym.imp.USER32.dll_GetWindowTextW]
call fcn.0045f250
test eax, eax
je 0x454911
mov ecx, dword [eax]
lea edx, [ebp - 0x20c]
push edx
push eax
call dword [ecx + 0x30]
test eax, eax
jne 0x454911
lea esi, [eax + 1]
jmp 0x454913
xor esi, esi
mov edx, dword [edi + 0x8c]
test edx, edx
je 0x454929
mov ecx, dword [edx]
mov eax, esi
xor eax, 1
push eax
push edx
call dword [ecx + 0x14]
mov ecx, dword [edi + 0x84]
test ecx, ecx
je 0x45493a
mov eax, dword [ecx]
push esi
push ecx
call dword [eax + 0x2c]
mov ecx, dword [edi + 0x88]
test ecx, ecx
je 0x454966
mov eax, dword [ecx]
push esi
push ecx
call dword [eax + 0x2c]
test esi, esi
mov ecx, 0x73d400
mov eax, 0xcbcbcb
cmovne eax, ecx
mov ecx, dword [edi + 0x88]
push eax
call fcn.0041cec0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0049a028
mov esp, ebp
pop ebp
ret
Function at 0x454980
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52cf26
mov eax, dword fs:[0]
push eax
mov eax, 0x402c
call fcn.0049a480
mov eax, dword [0x583bb4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x2000
lea eax, [ebp - 0x2010]
push 0
push eax
call fcn.004d1a10
add esp, 0xc
lea eax, [ebp - 0x2010]
push 0x1000
push eax
push dword [edi + 0x58]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [edi + 4]
mov dword [ebp - 0x4038], eax
lea eax, [ebp - 0x2010]
mov dword [ebp - 0x4030], eax
mov dword [ebp - 0x4020], eax
lea eax, [ebp - 0x4038]
push eax
mov dword [ebp - 0x402c], 0x548458
mov dword [ebp - 0x4028], 0x59
mov dword [ebp - 0x401c], 0
mov dword [ebp - 0x4024], 0x453c20
mov dword [ebp - 0x4034], 0
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov esi, eax
test esi, esi
je 0x454baa
push 0x2000
lea eax, [ebp - 0x4010]
push 0
push eax
call fcn.004d1a10
add esp, 0xc
lea eax, [ebp - 0x4010]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x454ba3
lea eax, [ebp - 0x4010]
push eax
lea ecx, [ebp - 0x4014]
call fcn.0040df50
push 7
lea eax, [ebp - 0x4018]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x4014]
call fcn.00423fc0
mov esi, dword [ebp - 0x4018]
push str.ludashi
push esi
mov byte [ebp - 4], 1
call fcn.004fc6e2
add esp, 8
test eax, eax
je 0x454b54
mov edx, dword [ebp - 0x4014]
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, 0x1000
or eax, ecx
jge 0x454aeb
push 0x1000
lea ecx, [ebp - 0x4014]
call fcn.0040afd0
mov edx, dword [ebp - 0x4014]
cmp dword [edx - 8], 0x1000
jl 0x454bc9
mov dword [edx - 0xc], 0x1000
xor ecx, ecx
mov eax, dword [ebp - 0x4014]
push str.ludashi
push edx
mov word [eax + 0x2000], cx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, dword [ebp - 0x4014]
push dword [eax - 8]
push eax
call fcn.004fd570
mov edx, eax
add esp, 8
test edx, edx
js 0x454bc9
mov ecx, dword [ebp - 0x4014]
cmp edx, dword [ecx - 8]
jg 0x454bc9
mov dword [ecx - 0xc], edx
xor ecx, ecx
mov eax, dword [ebp - 0x4014]
mov word [eax + edx*2], cx
push dword [ebp - 0x4014]
push dword [edi + 0x58]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x454b81
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x4014]
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x454ba3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, edi
call fcn.004548b0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049a028
mov esp, ebp
pop ebp
ret 0x10
push 0x80070057
call fcn.0040ab80
int3
Function at 0x454fb0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52d02b
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x583bb4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push esi
call fcn.00420880
call fcn.0043e4f0
mov ecx, eax
call fcn.00439900
cmp dword [eax], 0
je 0x454fff
lea ecx, [esi - 0x24]
call fcn.004553a0
call fcn.0043e4f0
cmp dword [eax + 0x70], 0
je 0x4550c9
call fcn.0045f250
push 0x208
mov edi, eax
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004d1a10
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [esi + 0x34]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [edi]
lea ecx, [ebp - 0x218]
push ecx
push edi
call dword [eax + 0x30]
test eax, eax
je 0x455069
push 0xa
lea ecx, [esi + 4]
call fcn.00453e10
test eax, eax
je 0x4550c9
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x14]
jmp 0x4550c9
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040df50
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], 0
call fcn.00436180
lea ecx, [ebp - 0x21c]
call fcn.00436280
push dword [ebp - 0x21c]
mov eax, dword [edi]
push edi
call dword [eax + 0x24]
mov edx, dword [ebp - 0x21c]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4550c9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.0043e4f0
mov ecx, eax
call fcn.004398e0
cmp dword [eax], 0
je 0x4550ec
push 0
push 0
push 0x15eb
push dword [esi - 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049a028
mov esp, ebp
pop ebp
ret 4
Function at 0x4553a0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52d0c1
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x583bb4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0045f250
push 0x208
mov edi, eax
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004d1a10
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [esi + 0x58]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [edi]
lea ecx, [ebp - 0x218]
push ecx
push edi
call dword [eax + 0x30]
test eax, eax
je 0x455431
push 0xa
lea ecx, [esi + 0x28]
call fcn.00453e10
test eax, eax
je 0x4554fa
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x14]
jmp 0x4554fa
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040df50
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], 0
call fcn.00436180
lea ecx, [ebp - 0x21c]
call fcn.00436280
push dword [ebp - 0x21c]
mov eax, dword [edi]
push edi
call dword [eax + 0x24]
mov eax, dword [esi + 0x44]
push 2
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
push 0
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x220], esp
mov dword [eax + 0x24], 0
push 0
push 0
push str.startpage_install
mov byte [ebp - 4], 1
call fcn.0042f030
mov ecx, eax
mov byte [ebp - 4], 0
call fcn.0042b2d0
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x220], esp
mov dword [eax + 0x24], 0
push 0
push str.startpage_install
mov byte [ebp - 4], 2
call fcn.0042f030
mov ecx, eax
mov byte [ebp - 4], 0
call fcn.0042aed0
mov edx, dword [ebp - 0x21c]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4554fa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049a028
mov esp, ebp
pop ebp
ret
Function at 0x45f130
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x583bb4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test esi, esi
je 0x45f1e4
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004d1a10
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ecx, edi
push 0x104
push eax
call fcn.0045f280
test eax, eax
jne 0x45f1ac
push 1
push 0x26
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.LuDaShi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004fcc77
add esp, 0xc
mov eax, dword [edi]
lea ecx, [ebp - 0x20c]
push ecx
push edi
call dword [eax + 0x30]
test eax, eax
je 0x45f1d1
push 0x12c
call fcn.004109c0
add esp, 4
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x10]
push esi
call fcn.004fcd4c
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0049a028
mov esp, ebp
pop ebp
ret 0xc

Function at 0x45f280
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52e0cb
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x583bb4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
test esi, esi
jne 0x45f2bb
xor eax, eax
jmp 0x45f3c5
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004d1a10
lea eax, [ebp - 0x248]
mov dword [ebp - 0x250], 1
push 1
push eax
mov dword [ebp - 0x24c], 0x208
call fcn.00433360
add esp, 0x14
mov edx, eax
cmp dword [edx + 0x14], 8
mov dword [ebp - 4], 0
jb 0x45f304
mov edx, dword [edx]
mov ecx, edx
mov dword [ebp - 0x220], 0
xor eax, eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45f326
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x230]
call fcn.00436a80
lea ecx, [ebp - 0x248]
call fcn.00425e20
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x24c]
push ecx
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x250]
push ecx
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push str.Setup_Path
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x45f3b6
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45f3b6
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 0xc]
push esi
call fcn.004fcd4c
add esp, 0xc
mov esi, 1
jmp 0x45f3b8
xor esi, esi
lea ecx, [ebp - 0x230]
call fcn.00425e20
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049a028
mov esp, ebp
pop ebp
ret 8
Function at 0x45fde0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52e1f6
mov eax, dword fs:[0]
push eax
sub esp, 0x818
mov eax, dword [0x583bb4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x824]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x818], eax
call fcn.004269e0
push esi
push edi
push ebx
lea ecx, [ebp - 0x824]
mov dword [ebp - 4], 0
call fcn.00426db0
test eax, eax
jne 0x45fe4b
xor edi, edi
jmp 0x45ff43
call fcn.0040cb40
mov ecx, eax
test ecx, ecx
je 0x45ff6e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x814], eax
push 0
lea eax, [ebp - 0x814]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x824]
call fcn.00426fb0
test eax, eax
je 0x45ff1f
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.004d1a10
add esp, 0xc
lea eax, [ebp - 0x810]
push 0x54cf08
push dword [ebp - 0x814]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x810]
push eax
call fcn.00493dc0
add esp, 4
test eax, eax
je 0x45ff1f
lea eax, [ebp - 0x810]
push eax
call fcn.004a2820
mov ecx, dword [ebp - 0x818]
lea edx, [ebp - 0x810]
mov edi, eax
lea esi, [edx + 2]
lea ecx, [ecx + 0x20c]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x45fef0
sub edx, esi
lea eax, [ebp - 0x810]
sar edx, 1
push edx
push eax
call fcn.0040d780
push 4
push 0
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x45ff21
xor edi, edi
mov esi, dword [ebp - 0x814]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x45ff43
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [ebp - 0x824]
call fcn.00426a00
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049a028
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.0040ab80
int3
Function at 0x4600d0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52e236
mov eax, dword fs:[0]
push eax
sub esp, 0x818
mov eax, dword [0x583bb4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x18]
lea ecx, [ebp - 0x824]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x818], eax
call fcn.004269e0
push esi
push edi
push ebx
lea ecx, [ebp - 0x824]
mov dword [ebp - 4], 0
call fcn.00426db0
test eax, eax
jne 0x46013b
xor esi, esi
jmp 0x46020b
call fcn.0040cb40
mov ecx, eax
test ecx, ecx
je 0x460236
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x814], eax
push 1
lea eax, [ebp - 0x814]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x824]
call fcn.00426fb0
test eax, eax
je 0x4601e7
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.004d1a10
add esp, 0xc
lea eax, [ebp - 0x810]
push 0x5409c8
push dword [ebp - 0x814]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x810]
push eax
call fcn.00493dc0
add esp, 4
test eax, eax
je 0x4601e7
push 4
push 0
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [ebp - 0x810]
push eax
push 0x400
push dword [ebp - 0x818]
call fcn.004fcd4c
add esp, 0xc
mov esi, 1
jmp 0x4601e9
xor esi, esi
mov edi, dword [ebp - 0x814]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x46020b
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [ebp - 0x824]
call fcn.00426a00
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049a028
mov esp, ebp
pop ebp
ret 0x14
push 0x80004005
call fcn.0040ab80
int3
Function at 0x460720
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52e320
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x583bb4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x46075b
mov eax, dword [ecx]
push ecx
call dword [eax]
mov dword [ebx + 0xc], 0
cmp dword [ebp + 0xc], 1
jne 0x4607fd
mov ecx, dword [ebx + 0xe8]
test ecx, ecx
je 0x4607fd
call fcn.0046cd90
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.0040c3d0
lea edi, [eax + 0x10]
mov dword [ebp + 0xc], edi
mov eax, dword [ebx + 8]
sub eax, 0x10
mov dword [ebp - 4], 0
push eax
call fcn.0040c3d0
add eax, 0x10
add esp, 8
mov dword [ebp + 8], eax
push str.FileList.xml
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.00446e20
mov esi, dword [ebp + 8]
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4607e1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], esi
dec esi
test esi, esi
jg 0x4607fd
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx + 0xe8]
test eax, eax
jne 0x460818
mov eax, dword [eax]
push 0
call dword [eax + 0x4c]
mov dword [ebx + 0xe8], 0
push dword [ebx + 0x21c]
lea ecx, [ebx + 0xa8]
call fcn.004651b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8