joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ce0c
Capabilities:
Create directory
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
xor ebx, ebx
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.004384e0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x18]
call fcn.00455c04
add esp, 0x14
test eax, eax
je 0x45cf55
lea eax, [ebp + 0x18]
push eax
push 0x4691d8
push 1
push ebx
push 0x469358
mov dword [ebp + 0x18], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
cmp esi, ebx
jl 0x45cf58
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push 0x4692a8
push eax
call dword [ecx]
mov esi, eax
cmp esi, ebx
jl 0x45cf4a
mov eax, dword [ebp + 0x18]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp + 0x18]
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov ecx, dword [ebp + 0x1c]
cmp dword [ebp + 0x1c], ebx
jne 0x45ceb3
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x18]
mov edx, dword [eax]
push ebx
push ecx
push eax
call dword [edx + 0x44]
mov esi, eax
cmp esi, ebx
jl 0x45cf41
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp dword [ebp + 0x14], ebx
je 0x45cedb
push dword [ebp + 0x14]
lea eax, [ebp - 0x20c]
push eax
call esi
push edi
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
call esi
lea edi, [ebp - 0x20c]
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x45ceff
mov eax, dword [ebp - 4]
mov esi, 0x46d264
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 1
lea edx, [ebp - 0x20c]
push edx
movsw word es:[edi], word [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
push ebx
mov esi, eax
lea eax, [ebp - 0x20c]
push eax
push 0x3001
push 0x2000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
pop edi
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x45cf58
mov esi, dword [ebp + 0x1c]
mov eax, esi
pop esi
pop ebx
leave
ret 0x18
Function at 0x45cf94
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x410], ax
lea eax, [ebp - 0x40e]
push eax
call fcn.004384e0
xor eax, eax
push esi
push eax
mov word [ebp - 0x208], ax
lea eax, [ebp - 0x206]
push eax
call fcn.004384e0
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 0x10]
call fcn.00455c04
add esp, 0x20
test eax, eax
je 0x45d065
cmp dword [ebp + 0xc], 0
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
je 0x45d019
push dword [ebp + 0xc]
lea eax, [ebp - 0x208]
push eax
call esi
xor eax, eax
movzx ecx, word [ebp + eax - 0x208]
mov word [ebp + eax - 0x410], cx
add eax, 2
test cx, cx
jne 0x45d001
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call esi
lea edi, [ebp - 0x208]
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x45d02f
mov esi, 0x46d264
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x208]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp + 0xc], 0
pop edi
je 0x45d065
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop esi
leave
ret
Function at 0x45d535
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [eax], ebx
mov eax, dword [ebp + 0xc]
push edi
push 0x103
mov dword [eax], ebx
lea eax, [ebp - 0x133]
push ebx
push eax
mov byte [ebp - 0x134], bl
call fcn.004384e0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x134]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
push ebx
push 3
push ebx
push 5
push SysReAllocString
lea eax, [ebp - 0x134]
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp - 4], edi
cmp edi, 0xffffffff
jne 0x45d5aa
xor eax, eax
jmp 0x45d6f9
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
push ebx
push 0x3c
push edi
call esi
push ebx
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
call edi
push ebx
push ebx
push dword [ebp - 0x14]
push dword [ebp - 4]
call esi
push ebx
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 4]
call edi
cmp dword [ebp - 0x20], 0x4550
jne 0x45d6e5
mov eax, dword [ebp - 0x14]
push ebx
add eax, 0x18
push ebx
push eax
push dword [ebp - 4]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], ebx
call esi
push ebx
lea eax, [ebp - 0xc]
push eax
push 2
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
call edi
mov eax, 0x10b
cmp word [ebp - 0x10], ax
jne 0x45d628
sub dword [ebp - 8], 0xffffff80
jmp 0x45d63f
mov eax, 0x20b
cmp word [ebp - 0x10], ax
jne 0x45d63c
add dword [ebp - 8], 0x90
jmp 0x45d63f
mov dword [ebp - 8], ebx
cmp dword [ebp - 8], ebx
je 0x45d6e5
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call esi
push ebx
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 4]
call edi
xor eax, eax
mov dword [ebp - 0x30], ebx
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x45d6e5
push ebx
push ebx
add eax, 0xfffffff0
push eax
push dword [ebp - 4]
call esi
push ebx
lea eax, [ebp - 8]
push eax
push 0x10
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x30], ebx
jne 0x45d6e5
cmp dword [ebp - 0x2c], ebx
jne 0x45d6e5
cmp dword [ebp - 0x28], ebx
jne 0x45d6e5
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x45d6e5
mov edi, dword [ebp + 0xc]
push eax
mov dword [edi], eax
call fcn.00434229
pop ecx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [edi]
push ebx
push ebx
sub eax, 0x10
push eax
push dword [ebp - 4]
call esi
push ebx
lea eax, [ebp - 8]
push eax
push dword [edi]
mov eax, dword [ebp + 8]
push dword [eax]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
xor eax, eax
cmp dword [ecx], ebx
pop esi
setne al
pop edi
pop ebx
leave
ret
Function at 0x45d836
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.kernel32
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x46c650
push eax
mov dword [0x48a878], eax
call esi
push str.user32
mov dword [0x48a87c], eax
call edi
push str.SetWindowTextW
push eax
mov dword [0x48a880], eax
call esi
push str.GetWindowTextW
push dword [0x48a880]
mov dword [0x48a884], eax
call esi
mov dword [0x48a888], eax
xor eax, eax
pop edi
pop esi
cmp dword [0x48a87c], eax
je 0x45d8ac
mov byte [0x48a86b], 1
cmp dword [0x48a884], eax
jne 0x45d8b1
mov byte [0x48a86b], al
push 0x90
push eax
lea eax, [ebp - 0x90]
push eax
mov dword [ebp - 0x94], 0x94
call fcn.004384e0
add esp, 0xc
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x90], 5
sbb al, al
inc al
mov byte [0x48a86b], al
leave
ret

Function at 0x45e6aa
Capabilities:
Delete registry key

Disassembly:
lea ecx, [eax + 0x208]
push ecx
add eax, 0x30c
call fcn.004013ae
pop ecx
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
ret
Function at 0x45e79a
Capabilities:
Check http status code
Create http request
Reference http user-agent string

Disassembly:
mov eax, 0x4661e0
call fcn.00465a14
sub esp, 0x410
push ebx
push esi
mov esi, 0x104
push esi
call fcn.00434229
push esi
xor ebx, ebx
push ebx
push eax
mov dword [ebp - 0x14], eax
call fcn.004384e0
mov eax, dword [0x48a86c]
add esp, 0x10
cmp byte [eax + 0xac8f], bl
je 0x45e99a
lea esi, [eax + 0xac90]
cmp esi, ebx
je 0x45e99a
lea edx, [esi + 1]
mov cl, byte [esi]
inc esi
cmp cl, bl
jne 0x45e7e9
sub esi, edx
je 0x45e99a
add eax, 0xb594
cmp eax, ebx
je 0x45e99a
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x45e808
sub eax, edx
je 0x45e99a
push edi
push ebx
push ebx
push ebx
push ebx
push str.Mozilla_5.0__Windows__U__Windows_NT_5.1__en_GB__rv:1.9.0.5__Gecko_2008120122_Firefox_3.0.5
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ecx, dword [0x48a86c]
push ebx
push 0x40300
push ebx
push ebx
add ecx, 0xac90
push ecx
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
push 0x3ff
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x41b]
push ebx
push eax
mov byte [ebp - 0x41c], bl
call fcn.004384e0
mov esi, dword [sym.imp.WININET.dll_HttpQueryInfoA]
add esp, 0xc
push ebx
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x41c]
push eax
push 0x13
push dword [ebp - 0x18]
mov edi, 0x400
mov dword [ebp - 0x1c], edi
call esi
lea eax, [ebp - 0x41c]
push eax
call fcn.00433f5a
pop ecx
mov byte [ebp - 0x41c], bl
mov dword [ebp - 0x1c], edi
cmp eax, 0xc8
jne 0x45e908
push ebx
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x41c]
push eax
push 0x2f
push dword [ebp - 0x18]
call esi
test eax, eax
jne 0x45e8bf
mov byte [ebp - 0x41c], bl
lea eax, [ebp - 0x41c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x45e8c8
sub eax, edx
cmp eax, ebx
je 0x45e908
lea eax, [ebp - 0x41c]
push str.filename
push eax
call fcn.004342d0
mov edi, eax
pop ecx
pop ecx
cmp edi, ebx
je 0x45e908
add edi, 9
push 0x46d260
push edi
call fcn.004342d0
pop ecx
pop ecx
cmp eax, ebx
je 0x45e904
mov byte [eax], bl
cmp edi, ebx
jne 0x45e923
mov eax, dword [0x48a86c]
add eax, 0xac90
push 0x2f
push eax
call fcn.00434040
mov edi, eax
pop ecx
pop ecx
cmp edi, ebx
je 0x45e923
inc edi
push dword [ebp - 0x18]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 0x10]
call esi
mov eax, dword [0x48a86c]
call fcn.0045d068
push 0x1414
mov esi, eax
call fcn.00433bd9
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x45e966
push esi
push dword [0x48a86c]
mov esi, eax
call fcn.0045e594
mov esi, eax
jmp 0x45e968
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xef2]
push eax
push 0x46c6dc
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push edi
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
pop edi
cmp esi, ebx
je 0x45e99a
push esi
call fcn.00433b53
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x45ed6e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x2001f
xor edi, edi
push edi
push dword [ebp + 8]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x45edd3
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
push edi
push dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
push dword [ebp - 4]
call esi
mov eax, dword [ebx]
inc eax
push eax
call fcn.00434229
pop ecx
push ebx
mov edi, eax
push edi
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call esi
test eax, eax
je 0x45edd3
test edi, edi
je 0x45edd1
push edi
call fcn.00434554
pop ecx
xor edi, edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x14], 0
je 0x45edf6
test edi, edi
je 0x45ee00
push dword [ebx]
push edi
push str.BlindCaffineSubstituteFamousCurtainTrickKingTinHalcyonDaysArapaho
call fcn.0046587e
add esp, 0xc
test edi, edi
je 0x45ee00
mov eax, dword [ebx]
mov byte [edi + eax], 0
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x45ee06
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [ebp + 0x1c], esi
je 0x45ee25
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push str.BlindCaffineSubstituteFamousCurtainTrickKingTinHalcyonDaysArapaho
call fcn.0046587e
add esp, 0xc
push esi
lea eax, [ebp + 0x1c]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push dword [ebp + 8]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x45ee5b
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
push dword [ebp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
pop ebp
ret
Function at 0x46045f
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1430
call fcn.00438700
mov eax, dword [ebp + 8]
push ebx
push esi
lea ecx, [eax + 0x208]
push edi
push ecx
add eax, 0x30c
call fcn.004013ae
pop ecx
xor edi, edi
push edi
mov esi, eax
push 0x46ce24
push esi
call fcn.0045fa50
add esp, 0xc
push 1
push 0x46d468
push esi
mov dword [ebp - 8], eax
call fcn.0045fa50
add esp, 0xc
push edi
push 0x46d46c
push esi
mov dword [ebp - 0xc], eax
call fcn.0045fa50
add esp, 0xc
mov dword [ebp - 0x14], eax
push 0x46c6d4
push esi
xor eax, eax
call fcn.0045f8f1
mov dword [ebp - 0x1c], eax
push 0x46d470
push esi
xor eax, eax
call fcn.0045f8f1
push edi
mov ebx, 0x46d478
push ebx
push esi
mov dword [ebp + 8], eax
call fcn.0045fa50
add esp, 0x1c
push 1
mov edi, 0x46d484
push edi
push esi
mov dword [ebp - 0x18], eax
call fcn.0045fa50
add esp, 0xc
push esi
push SysReAllocString
mov dword [ebp - 0x10], eax
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push 0
push dword [ebp - 0x18]
push ebx
push esi
call fcn.0045f932
push 1
push dword [ebp - 0x10]
push edi
push esi
call fcn.0045f932
mov eax, dword [0x48a86c]
add esp, 0x20
test dword [eax + 0xac87], 2
jne 0x460551
push 0
push dword [ebp - 8]
push 0x46ce24
push esi
call fcn.0045f932
add esp, 0x10
mov eax, dword [0x48a86c]
test dword [eax + 0xac87], 1
jne 0x460573
push dword [ebp - 0x1c]
push 0x46c6d4
push esi
call fcn.0045f8d2
add esp, 0xc
mov eax, dword [0x48a86c]
test dword [eax + 0xac87], 4
jne 0x4605ae
cmp dword [ebp + 8], 0
je 0x4605ae
push dword [ebp + 8]
push 0x46d470
push esi
call fcn.0045f8d2
add esp, 0xc
push 1
push dword [ebp - 0xc]
push 0x46d468
push esi
call fcn.0045f932
add esp, 0x10
mov edi, dword [ebp - 0x14]
test edi, edi
je 0x4605d6
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4605ba
sub eax, edx
je 0x4605d6
push 0
push edi
push 0x46d46c
push esi
call fcn.0045f932
add esp, 0x10
push 0
call fcn.004345cc
pop ecx
mov dword [ebp - 0x24], eax
push SysReAllocString
mov ecx, esi
lea eax, [ebp - 0x142c]
mov dword [ebp - 0x20], edx
call fcn.00456a6e
push 8
lea eax, [ebp - 0x24]
push eax
push 0xb
push 0x46c6e8
lea eax, [ebp - 0x142c]
call fcn.00456c43
push esi
call fcn.00434554
pop ecx
push dword [ebp - 8]
call fcn.00434554
pop ecx
push dword [ebp - 0xc]
call fcn.00434554
pop ecx
push edi
call fcn.00434554
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4616da
Capabilities:
Create process on windows
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2044
call fcn.00438700
push ebx
push edi
mov edi, dword [0x48a86c]
lea eax, [edi + 0x2758]
mov dword [ebp - 4], eax
lea edx, [eax + 1]
xor ebx, ebx
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4616fd
sub eax, edx
je 0x461870
cmp dword [edi + 0x906e], ebx
je 0x461870
push esi
mov esi, 0x3ff
push esi
lea eax, [ebp - 0x1843]
push ebx
push eax
mov byte [ebp - 0x1844], bl
call fcn.004384e0
push esi
lea eax, [ebp - 0x443]
push ebx
push eax
mov byte [ebp - 0x444], bl
call fcn.004384e0
push esi
lea eax, [ebp - 0x1043]
push ebx
push eax
mov byte [ebp - 0x1044], bl
call fcn.004384e0
push esi
lea eax, [ebp - 0x843]
push ebx
push eax
mov byte [ebp - 0x844], bl
call fcn.004384e0
push esi
lea eax, [ebp - 0xc43]
push ebx
push eax
mov byte [ebp - 0xc44], bl
call fcn.004384e0
push esi
lea eax, [ebp - 0x1443]
push ebx
push eax
mov byte [ebp - 0x1444], bl
call fcn.004384e0
lea eax, [ebp - 0x1844]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x444]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x1044]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x844]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0xc44]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1444]
add esp, 0x48
mov dword [ebp - 0x28], eax
lea eax, [esi + 1]
push 0x7ff
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2043]
push ebx
push eax
mov dword [ebp - 0x44], 0x3c
mov byte [ebp - 0x2044], bl
call fcn.004384e0
mov ecx, dword [ebp - 4]
push edi
push fcn.00461236
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x103
lea eax, [ebp - 0x2044]
call fcn.0045d0af
lea eax, [ebp - 0x2044]
add esp, 0x20
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x461830
lea ecx, [ebp - 0x44]
push ecx
sub eax, esi
push ebx
push eax
lea eax, [ebp - 0x2044]
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
cmp dword [ebp - 0x38], 3
pop esi
je 0x461859
cmp dword [ebp - 0x38], 4
jne 0x461870
push 1
push ebx
push ebx
lea eax, [ebp - 0x2044]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop ebx
leave
ret
Function at 0x461874
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x48a86c]
sub esp, 0x10c
push ebx
xor ebx, ebx
cmp byte [eax + 0xac8f], bl
je 0x46198d
lea ecx, [eax + 0xac90]
cmp ecx, ebx
je 0x46198d
push esi
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x4618a3
sub ecx, esi
je 0x46198c
lea ecx, [eax + 0xb594]
cmp ecx, ebx
je 0x46198c
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x4618c3
sub ecx, esi
je 0x46198c
add eax, 0xb698
push eax
push SysReAllocString
call fcn.0045d6fd
pop ecx
pop ecx
test al, al
jne 0x46198c
mov eax, dword [0x48a86c]
add eax, 0xb698
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0045d6fd
pop ecx
pop ecx
test al, al
jne 0x46198c
call fcn.0045e79a
push 0x103
mov esi, eax
lea eax, [ebp - 0x10b]
push ebx
push eax
mov byte [ebp - 0x10c], bl
call fcn.004384e0
mov eax, dword [0x48a86c]
push eax
push fcn.00461236
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
lea ecx, [eax + 0xb490]
push 0x104
lea eax, [ebp - 0x10c]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call fcn.0045d0af
add esp, 0x20
cmp esi, ebx
je 0x461985
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x461965
sub eax, edx
je 0x461985
push 5
push ebx
lea eax, [ebp - 0x10c]
push eax
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push esi
call fcn.00434554
pop ecx
pop esi
pop ebx
leave
ret
Function at 0x461990
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
xor ebx, ebx
push edi
mov esi, eax
cmp dword [ebp + 0xc], ebx
je 0x461b1f
cmp dword [ebp + 0x10], ebx
je 0x461b1f
cmp esi, ebx
je 0x4619bb
cmp dword [esi + 4], ebx
jne 0x4619c0
cmp dword [esi + 0xc], ebx
je 0x461a02
xor eax, eax
cmp dword [esi + 4], ebx
je 0x4619e0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004611ec
add esp, 0xc
cmp eax, ebx
jne 0x461b21
cmp dword [esi + 0xc], ebx
je 0x461b21
push dword [ebp + 0x10]
add esi, 8
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004611ec
add esp, 0xc
jmp 0x461b21
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.004384e0
add esp, 0xc
push str.theme_
mov eax, 0x104
lea edi, [ebp - 0x108]
call fcn.004557b2
mov eax, dword [ebp + 8]
mov esi, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x461a37
lea edi, [ebp - 0x108]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x461a47
mov ecx, eax
shr ecx, 2
push ebx
rep movsd dword es:[edi], dword [esi]
push ebx
push 3
push ebx
push 1
mov ecx, eax
push SysReAllocString
lea eax, [ebp - 0x108]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x461add
push str.data_
mov eax, 0x104
lea edi, [ebp - 0x108]
call fcn.004557b2
mov eax, dword [ebp + 8]
mov esi, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x461a97
lea edi, [ebp - 0x108]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x461aa7
mov ecx, eax
shr ecx, 2
push ebx
rep movsd dword es:[edi], dword [esi]
push ebx
push 3
push ebx
push 1
mov ecx, eax
push SysReAllocString
lea eax, [ebp - 0x108]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x461b1f
push ebx
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
inc eax
push eax
call fcn.00434229
pop ecx
mov ecx, dword [ebp + 0xc]
push ebx
mov dword [ecx], eax
lea ecx, [ebp - 4]
push ecx
push dword [esi]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [esi]
push edi
mov byte [eax + ecx], bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x461b21
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x463a46
Capabilities:
Copy file
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x564
push ebx
push esi
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x260]
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x364]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, dword [0x48a86c]
test byte [eax + 0x9066], 1
mov edi, dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
je 0x463aa6
lea ecx, [ebp - 0x15c]
push ecx
push esi
add eax, 0x9175
push eax
lea eax, [ebp - 0x364]
push eax
call edi
mov eax, dword [0x48a86c]
test byte [eax + 0x9066], 2
je 0x463ac6
lea ecx, [ebp - 0x15c]
push ecx
push esi
add eax, 0x89dc
push eax
lea eax, [ebp - 0x364]
push eax
call edi
push esi
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push esi
push 0x4000000
push 3
push esi
push 1
push esi
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
lea eax, [ebp - 0x260]
push eax
push ebx
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x564]
push str._s__cleanup__d___s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x44
pop edi
push edi
lea eax, [ebp - 0x58]
push esi
push eax
call fcn.004384e0
add esp, 0x20
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
push esi
push esi
push 1
push esi
push esi
lea eax, [ebp - 0x564]
push eax
push esi
mov dword [ebp - 0x58], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x463b98
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x5c
push dword [ebp + 0xc]
call fcn.00434040
pop ecx
pop ecx
test eax, eax
je 0x463bcb
mov byte [eax], 0
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop ebp
ret