joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458898
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4588af
add esp, 0xfffffff0
call fcn.00403b68
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a148
mov eax, dword [0x461a4c]
cmp word [eax + 2], 0
jne 0x4588d7
mov eax, dword [0x461a4c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045a348
mov eax, dword [0x461af8]
cmp word [eax + 2], 0
jne 0x4588f1
mov eax, dword [0x461af8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045a554
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411f44]
call fcn.0040382c
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411f44]
call fcn.0040382c
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x411f44]
call fcn.0040382c
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x41e564]
call fcn.004244c8
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x458aa8
mov eax, dword [0x461960]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042489c
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45ac14
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x461960]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040ca24
test eax, eax
je 0x4589f8
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408ccc
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040ca58
test eax, eax
je 0x458a0c
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004048e0
mov byte [ebx + 0xd4], 0
push ebx
push 0x459ea8
call fcn.0041b2c4
mov dword [ebx + 0xc8], eax
mov eax, dword [0x461850]
cmp byte [eax], 0
jne 0x458a5d
mov eax, ebx
call fcn.00458bec
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.0045adf0
mov eax, ebx
call fcn.0045b950
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x458a9d
call fcn.00403bc0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x458e6c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x465584]
cmp dword [eax + 0x30], 0
je 0x458f16
cmp dword [ebx + 0x94], 0
jne 0x458f10
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x458dfc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x458f10
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x458ed6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x458f10
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004142f0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x458ee5
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x459c30
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x459c65
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404760
jmp 0x459c72
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004046c4
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45afd4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45b042
mov eax, esi
call fcn.004456dc
test al, al
je 0x45b042
mov eax, dword [ebx + 0x84]
call fcn.0044533c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45b042
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x45b036
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044533c
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0043d728
jmp 0x45b042
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0045ae10
pop esi
pop ebx
ret
Function at 0x45cc00
Capabilities:
Check if file exists
Copy file
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x10c], edx
xor eax, eax
push ebp
push 0x45cd90
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov esi, eax
test esi, esi
je 0x45cc5c
lea eax, [ebp - 0x105]
push eax
call sub.shlwapi.dll_PathFileExistsA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x45cc74
push 0
push 0x45cda0
push 0x45cdb4
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x45cd72
cmp byte [ebp + esi - 0x106], 0x5c
je 0x45cc87
mov byte [ebp + esi - 0x105], 0x5c
inc esi
push 0x45cddc
lea eax, [ebp + esi - 0x105]
push eax
call sub.kernel32.dll_lstrcpyA
lea eax, [ebp - 0x105]
push eax
call sub.shlwapi.dll_PathFileExistsA
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x45cd03
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.004048e0
mov eax, dword [ebp - 0x10c]
call fcn.00404b34
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x105]
push eax
call sub.shlwapi.dll_PathFileExistsA
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x45cd03
push 0
push 0x45cda0
push 0x45cdec
push 0
call sub.user32.dll_MessageBoxA_1
xor ebx, ebx
jmp 0x45cd72
push 0
lea eax, [ebp - 0x105]
push eax
push 0x45ce20
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x45cd72
push 0
push 0x45cda0
push 0x45ce34
lea eax, [ebp - 0x114]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.004048e0
push dword [ebp - 0x114]
push 0x45ce5c
lea eax, [ebp - 0x110]
mov edx, 3
call fcn.004049f4
mov eax, dword [ebp - 0x110]
call fcn.00404b34
push eax
push 0
call sub.user32.dll_MessageBoxA_1
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45cd97
lea eax, [ebp - 0x114]
mov edx, 3
call fcn.00404694
ret
Function at 0x45ce70
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x10c], edx
mov edi, eax
xor eax, eax
push ebp
push 0x45d012
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov esi, eax
test esi, esi
je 0x45cec9
lea eax, [ebp - 0x105]
push eax
call sub.shlwapi.dll_PathFileExistsA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x45cee3
push 0
push 0x45d024
push 0x45d038
push 0
call sub.user32.dll_MessageBoxA_1
xor ebx, ebx
jmp 0x45cff4
cmp byte [ebp + esi - 0x106], 0x5c
je 0x45cef6
mov byte [ebp + esi - 0x105], 0x5c
inc esi
push 0x45d060
lea eax, [ebp + esi - 0x105]
push eax
call sub.kernel32.dll_lstrcpyA
lea eax, [ebp - 0x105]
push eax
call sub.shlwapi.dll_PathFileExistsA
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x45cf7f
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.004048e0
mov eax, dword [ebp - 0x10c]
call fcn.00404b34
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x105]
push eax
call sub.shlwapi.dll_PathFileExistsA
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x45cf7f
mov eax, dword [edi + 0x398]
xor edx, edx
call fcn.0042ee34
push 0
push 0x45d024
push 0x45d06c
push 0
call sub.user32.dll_MessageBoxA_1
xor ebx, ebx
jmp 0x45cff4
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov esi, eax
cmp byte [ebp + esi - 0x106], 0x5c
je 0x45cfa5
mov byte [ebp + esi - 0x105], 0x5c
inc esi
push 0x45d0a0
lea eax, [ebp + esi - 0x105]
push eax
call sub.kernel32.dll_lstrcpyA
lea eax, [ebp - 0x105]
push eax
call sub.shlwapi.dll_PathFileExistsA
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x45cff4
lea eax, [ebp - 0x110]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.004048e0
mov eax, dword [ebp - 0x110]
call fcn.00404b34
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d019
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.00404694
ret
Function at 0x45d0b0
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10c], edx
mov esi, eax
xor eax, eax
push ebp
push 0x45d1ce
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edi, eax
test edi, edi
je 0x45d103
lea eax, [ebp - 0x105]
push eax
call sub.shlwapi.dll_PathFileExistsA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x45d11b
push 0
push 0x45d1e0
push 0x45d1f4
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x45d1b5
cmp byte [ebp + edi - 0x106], 0x5c
je 0x45d12e
mov byte [ebp + edi - 0x105], 0x5c
inc edi
push 0x45d21c
lea eax, [ebp + edi - 0x105]
push eax
call sub.kernel32.dll_lstrcpyA
lea eax, [ebp - 0x105]
push eax
call sub.shlwapi.dll_PathFileExistsA
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x45d1b5
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.004048e0
mov eax, dword [ebp - 0x10c]
call fcn.00404b34
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x105]
push eax
call sub.shlwapi.dll_PathFileExistsA
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x45d1b5
xor edx, edx
mov eax, dword [esi + 0x398]
call fcn.0042ee34
push 0
push 0x45d1e0
push 0x45d230
push 0
call sub.user32.dll_MessageBoxA_1
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d1d5
lea eax, [ebp - 0x10c]
call fcn.00404670
ret
Function at 0x45d26c
Capabilities:
Check if file exists
Copy file
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x10c], edx
xor eax, eax
push ebp
push 0x45d40a
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov esi, eax
test esi, esi
je 0x45d2c8
lea eax, [ebp - 0x105]
push eax
call sub.shlwapi.dll_PathFileExistsA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x45d2e0
push 0
push 0x45d41c
push 0x45d430
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x45d3ec
cmp byte [ebp + esi - 0x106], 0x5c
je 0x45d2f3
mov byte [ebp + esi - 0x105], 0x5c
inc esi
push 0x45d458
lea eax, [ebp + esi - 0x105]
push eax
call sub.kernel32.dll_lstrcpyA
lea eax, [ebp - 0x105]
push eax
call sub.shlwapi.dll_PathFileExistsA
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x45d36f
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.004048e0
mov eax, dword [ebp - 0x10c]
call fcn.00404b34
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x105]
push eax
call sub.shlwapi.dll_PathFileExistsA
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x45d36f
push 0
push 0x45d41c
push 0x45d46c
push 0
call sub.user32.dll_MessageBoxA_1
xor ebx, ebx
jmp 0x45d3ec
push 0
lea eax, [ebp - 0x105]
push eax
push 0x45d4a8
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x45d3e0
push 0
push 0x45d41c
push 0x45d4c0
lea eax, [ebp - 0x114]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.004048e0
push dword [ebp - 0x114]
push 0x45d4e8
lea eax, [ebp - 0x110]
mov edx, 3
call fcn.004049f4
mov eax, dword [ebp - 0x110]
call fcn.00404b34
push eax
push 0
call sub.user32.dll_MessageBoxA_1
xor ebx, ebx
jmp 0x45d3ec
lea eax, [ebp - 0x105]
push eax
call sub.gdi32.dll_AddFontResourceA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d411
lea eax, [ebp - 0x114]
mov edx, 3
call fcn.00404694
ret
Function at 0x45dd5c
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404b24
xor eax, eax
push ebp
push 0x45dee9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
push 0xf003f
push 0
push 0x45def8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45dec1
mov ebx, pe_nt_image_headers32
mov eax, ebx
xor edx, edx
push edx
push eax
lea edx, [ebp - 8]
mov eax, 8
call fcn.00408780
lea eax, [ebp - 0x14]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.00404b34
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
mov esi, eax
test esi, esi
jne 0x45deab
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1d]
push eax
push edi
push 0
push 0x45df1c
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45dea2
mov byte [ebp - 0x19], 0
lea ecx, [ebp - 0x24]
movzx eax, byte [ebp - 0x1a]
mov edx, 2
call fcn.00408758
push dword [ebp - 0x24]
lea ecx, [ebp - 0x28]
movzx eax, byte [ebp - 0x1b]
mov edx, 2
call fcn.00408758
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2c]
movzx eax, byte [ebp - 0x1c]
mov edx, 2
call fcn.00408758
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x30]
movzx eax, byte [ebp - 0x1d]
mov edx, 2
call fcn.00408758
push dword [ebp - 0x30]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.004049f4
mov eax, dword [ebp - 4]
call fcn.00404b34
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404b34
pop edx
call fcn.00408d80
test eax, eax
jne 0x45dea2
mov eax, dword [ebp - 8]
call fcn.00404b34
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegDeleteKeyA
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
inc ebx
cmp ebx, 0x1000
jb 0x45ddb9
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45def0
lea eax, [ebp - 0x30]
mov edx, 4
call fcn.00404694
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404694
ret
Function at 0x41a320
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
push ebx
push esi
push edi
lea edi, [ebp - 0x444]
mov ecx, 0x111
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x404], eax
mov ecx, dword [ebp - 0x404]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x400
lea eax, [ebp - 0x400]
push eax
call fcn.00457ef0
add esp, 0x10
mov dword [ebp - 0x404], 0
mov esi, esp
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.00457eb0
pop edi
pop esi
pop ebx
add esp, 0x444
cmp ebp, esp
call fcn.00457eb0
mov esp, ebp
pop ebp
ret

Function at 0x41bc40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x318c
call fcn.00458740
push ebx
push esi
push edi
lea edi, [ebp - 0x318c]
mov ecx, 0xc63
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
push 0x1000
push 0
lea eax, [ebp - 0x1144]
push eax
call fcn.00457a20
add esp, 0xc
mov esi, esp
lea ecx, [ebp - 0x1144]
push ecx
push 0x1000
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp esi, esp
call fcn.00457eb0
push 0x1000
push 0
lea edx, [ebp - 0x2144]
push edx
call fcn.00457a20
add esp, 0xc
push str.map.map
lea eax, [ebp - 0x1144]
push eax
push str._s_s
lea ecx, [ebp - 0x2144]
push ecx
call fcn.00457b00
add esp, 0x10
mov esi, esp
lea edx, [ebp - 0x140]
push edx
lea eax, [ebp - 0x2144]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp esi, esp
call fcn.00457eb0
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0xffffffff
je 0x41bddf
push 0x1000
push 0
lea ecx, [ebp - 0x3144]
push ecx
call fcn.00457a20
add esp, 0xc
lea edx, [ebp - 0x114]
push edx
push str.map_
lea eax, [ebp - 0x1144]
push eax
push str._s_s_s
lea ecx, [ebp - 0x3144]
push ecx
call fcn.00457b00
add esp, 0x14
push 0x4deb04
lea edx, [ebp - 0x3144]
push edx
call fcn.00458720
add esp, 8
mov dword [ebp - 0x3148], eax
cmp dword [ebp - 0x3148], 0
je 0x41bddf
push 2
push 0
mov eax, dword [ebp - 0x3148]
push eax
call fcn.00458500
add esp, 0xc
mov ecx, dword [ebp - 0x3148]
push ecx
call fcn.00458270
add esp, 4
mov dword [ebp - 0x314c], eax
mov edx, dword [ebp - 0x314c]
push edx
call fcn.00421f30
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
je 0x41bddf
push 0
push 0
mov eax, dword [ebp - 0x3148]
push eax
call fcn.00458500
add esp, 0xc
mov ecx, dword [ebp - 0x3148]
push ecx
push 1
mov edx, dword [ebp - 0x314c]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.004580a0
add esp, 0x10
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x314c]
mov dword [edx], eax
jmp 0x41bde8
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x318c
cmp ebp, esp
call fcn.00457eb0
mov esp, ebp
pop ebp
ret
Function at 0x422030
Capabilities:
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x358
push ebx
push esi
push edi
lea edi, [ebp - 0x358]
mov ecx, 0xd6
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov dword [ebp - 4], 0
jmp 0x422060
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xc8
jge 0x42207c
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*4 + 0x6ecfb0]
cmp edx, dword [ebp + 8]
jne 0x42207a
jmp 0x42207c
jmp 0x422057
cmp dword [ebp - 4], 0xc8
jl 0x422212
mov dword [ebp - 4], 0
jmp 0x42209b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xc8
jge 0x4220b5
mov ecx, dword [ebp - 4]
cmp dword [ecx*4 + 0x6ecfb0], 0
jne 0x4220b3
jmp 0x4220b5
jmp 0x422092
mov edx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [eax*4 + 0x6ecfb0], ecx
mov esi, esp
lea edx, [ebp - 0x10c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp esi, esp
call fcn.00457eb0
mov esi, esp
lea eax, [ebp - 0x210]
push eax
push 0
push 0x4ded4c
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
cmp esi, esp
call fcn.00457eb0
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x314]
push eax
call fcn.00457c00
add esp, 8
lea ecx, [ebp - 0x314]
push ecx
call fcn.00457a80
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
xor eax, eax
mov al, byte [edx + 8]
test eax, eax
jne 0x42215e
mov ecx, dword [ebp - 4]
mov byte [ebp + ecx - 0x317], 0x6d
mov edx, dword [ebp - 4]
mov byte [ebp + edx - 0x316], 0x69
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x315], 0x64
jmp 0x42217f
mov ecx, dword [ebp - 4]
mov byte [ebp + ecx - 0x317], 0x77
mov edx, dword [ebp - 4]
mov byte [ebp + edx - 0x316], 0x61
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x315], 0x76
mov esi, esp
lea ecx, [ebp - 0x314]
push ecx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp esi, esp
call fcn.00457eb0
lea eax, [ebp - 0x314]
push eax
mov ecx, dword [ebp + 8]
add ecx, 9
push ecx
call fcn.00457c00
add esp, 8
push 0x4ded48
mov edx, dword [ebp + 8]
add edx, 9
push edx
call fcn.00458720
add esp, 8
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0
je 0x422204
mov eax, dword [ebp - 0x318]
push eax
push 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.00458b50
add esp, 0x10
mov edx, dword [ebp - 0x318]
push edx
call fcn.00458a70
add esp, 4
jmp 0x422212
mov eax, dword [ebp - 8]
mov dword [eax*4 + 0x6ecfb0], 0
pop edi
pop esi
pop ebx
add esp, 0x358
cmp ebp, esp
call fcn.00457eb0
mov esp, ebp
pop ebp
ret
Function at 0x4222c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
lea edi, [ebp - 0x44]
mov ecx, 0x11
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
push 0
push 0
push 0
push str.close_nn
call dword [sym.imp.WINMM.dll_mciSendStringA]
cmp esi, esp
call fcn.00457eb0
mov dword [ebp - 4], 0
jmp 0x422304
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xc8
jge 0x422339
mov ecx, dword [ebp - 4]
cmp dword [ecx*4 + 0x6ecfb0], 0
je 0x422337
mov edx, dword [ebp - 4]
mov eax, dword [edx*4 + 0x6ecfb0]
add eax, 9
mov esi, esp
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp esi, esp
call fcn.00457eb0
jmp 0x4222fb
pop edi
pop esi
pop ebx
add esp, 0x44
cmp ebp, esp
call fcn.00457eb0
mov esp, ebp
pop ebp
ret
Function at 0x42aea0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48c
push ebx
push esi
push edi
lea edi, [ebp - 0x48c]
mov ecx, 0x123
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov byte [ebp - 0x40], 0
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0x3f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x5c
mov eax, dword [ebp + 8]
push eax
call fcn.004589c0
add esp, 8
mov dword [ebp - 0x44], eax
push 0x2e
mov ecx, dword [ebp + 8]
push ecx
call fcn.004589c0
add esp, 8
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], 0
mov byte [ebp - 0x44c], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x44b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edx, dword [ebp - 0x48]
sub edx, dword [ebp - 0x44]
sub edx, 1
push edx
mov eax, dword [ebp - 0x44]
add eax, 1
push eax
lea ecx, [ebp - 0x40]
push ecx
call fcn.0045b150
add esp, 0xc
push 0x5f
lea edx, [ebp - 0x40]
push edx
call fcn.004589c0
add esp, 8
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x42af76
mov eax, dword [ebp - 0x4c]
add eax, 1
push eax
call fcn.00457a80
add esp, 4
cmp eax, 3
jne 0x42af76
mov ecx, dword [ebp - 0x4c]
add ecx, 1
push ecx
call fcn.0045b000
add esp, 4
cmp eax, 0x3e8
jge 0x42af76
jmp 0x42aff7
lea edx, [ebp - 0x40]
push edx
push str.C:_soyououtexe_s
lea eax, [ebp - 0x44c]
push eax
call fcn.00457b00
add esp, 0xc
push 0
lea ecx, [ebp - 0x44c]
push ecx
call fcn.0046cf30
add esp, 8
test eax, eax
jge 0x42afb2
lea edx, [ebp - 0x44c]
push edx
call fcn.0046cee0
add esp, 4
mov eax, dword [0x4ead54]
push eax
mov ecx, dword [0x4ead50]
push ecx
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x40]
push eax
push str.C:_soyououtexe_s_s__d__d.exe
lea ecx, [ebp - 0x44c]
push ecx
call fcn.00457b00
add esp, 0x18
mov esi, esp
push 0
lea edx, [ebp - 0x44c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp esi, esp
call fcn.00457eb0
pop edi
pop esi
pop ebx
add esp, 0x48c
cmp ebp, esp
call fcn.00457eb0
mov esp, ebp
pop ebp
ret

Function at 0x42b230
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
lea edi, [ebp - 0x4c]
mov ecx, 0x13
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov byte [ebp - 0xc], 0x6d
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x72
mov byte [ebp - 7], 0x76
mov byte [ebp - 6], 0x32
mov byte [ebp - 5], 0x2e
mov byte [ebp - 4], 0x64
mov byte [ebp - 3], 0x6c
mov byte [ebp - 2], 0x6c
mov byte [ebp - 1], 0
push 0xc
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004576e0
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0x4c
cmp ebp, esp
call fcn.00457eb0
mov esp, ebp
pop ebp
ret