joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d730
Capabilities:
Accept command line arguments
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xc0]
sub esp, 0x140
mov eax, dword [0x4832f0]
xor eax, ebp
mov dword [ebp + 0xbc], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x73]
push 0
push eax
mov byte [ebp - 0x74], 0
call fcn.0044e9d0
mov ecx, 0xb
mov esi, 0x475928
lea edi, [ebp + 0x90]
lea eax, [ebp + 0x90]
add esp, 0xc
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x80], 0x104
rep movsd dword es:[edi], dword [esi]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d790
lea ecx, [ebp + 0x90]
sub eax, edx
push ecx
mov edx, 0x1586a
call fcn.0041d880
add esp, 4
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x7c]
push ecx
push 0x475954
lea edx, [ebp + 0x90]
push edx
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x41d843
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
cmp edi, 0x3fffffff
jg 0x41d815
lea eax, [edi + edi]
call fcn.00457700
mov esi, esp
test esi, esi
je 0x41d815
push edi
push esi
push 0xffffffffffffffff
lea edx, [ebp - 0x74]
xor ecx, ecx
push edx
push ecx
push 3
mov word [esi], cx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb eax, eax
and eax, esi
jmp 0x41d817
xor eax, eax
lea ecx, [ebp - 0x78]
push ecx
push eax
mov dword [ebp - 0x78], 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
je 0x41d843
mov edx, dword [esi]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push esi
test eax, eax
jne 0x41d847
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
jmp 0x41d852
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
lea esp, [ebp - 0x88]
pop edi
pop esi
mov ecx, dword [ebp + 0xbc]
xor ecx, ebp
call fcn.0044b6ee
add ebp, 0xc0
mov esp, ebp
pop ebp
ret
Function at 0x41d8c0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub esp, 0x144
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x140], eax
push esi
push edi
push 0x103
lea eax, [esp + 0x49]
push 0
push eax
mov byte [esp + 0x50], 0
call fcn.0044e9d0
mov edx, dword [0x475984]
mov eax, dword [0x475988]
mov ecx, 8
mov esi, 0x475960
lea edi, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x475980]
add esp, 0xc
mov dword [esp + 0x14], edx
mov dl, byte [0x475990]
mov dword [esp + 0x10], ecx
mov ecx, dword [0x47598c]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x24]
pop edi
mov byte [esp + 0x1c], dl
mov dword [esp + 8], 1
mov dword [esp + 4], 0x104
mov dword [esp + 0x18], ecx
lea edx, [eax + 1]
pop esi
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d950
lea ecx, [esp + 0x1c]
sub eax, edx
push ecx
mov edx, 0x237f
call fcn.0041d880
lea eax, [esp + 0xc]
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d972
sub eax, edx
lea edx, [esp + 8]
push edx
mov edx, 0x237f
call fcn.0041d880
add esp, 4
lea eax, [esp]
push eax
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0xc]
push edx
push str.AppPath
lea eax, [esp + 0x2c]
push eax
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x41d9f4
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x40]
push edx
mov eax, edx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
test eax, eax
je 0x41d9f4
lea ecx, [esp + 0x3c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x41d9f4
mov eax, 1
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x144
ret
mov ecx, dword [esp + 0x140]
xor ecx, esp
xor eax, eax
call fcn.0044b6ee
add esp, 0x144
ret
Function at 0x41da10
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub esp, 0x354
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x350], eax
push esi
push edi
push 0x103
lea eax, [esp + 0x155]
push 0
push eax
mov byte [esp + 0x15c], 0
call fcn.0044e9d0
push 0x103
lea ecx, [esp + 0x5d]
push 0
push ecx
mov byte [esp + 0x64], 0
call fcn.0044e9d0
push 0x103
lea edx, [esp + 0x271]
push 0
push edx
mov byte [esp + 0x278], 0
call fcn.0044e9d0
mov eax, dword [0x4759b4]
mov edx, dword [0x4759bc]
mov ecx, 5
mov esi, 0x47599c
lea edi, [esp + 0x58]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x4759b8]
mov dword [esp + 0x48], eax
mov eax, dword [0x4759c0]
mov dword [esp + 0x54], eax
mov ax, word [0x4759cc]
mov dword [esp + 0x50], edx
mov edx, dword [0x4759c8]
mov dword [esp + 0x4c], ecx
mov ecx, dword [0x4759c4]
mov word [esp + 0x3c], ax
mov eax, dword [0x4759d4]
movsw word es:[edi], word [esi]
mov dword [esp + 0x38], edx
mov edx, dword [0x4759d0]
mov dword [esp + 0x34], ecx
mov cl, byte [0x4759ce]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x58]
mov dword [esp + 0x40], edx
add esp, 0x24
movsb byte es:[edi], byte [esi]
mov byte [esp + 0x1a], cl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41daf3
lea ecx, [esp + 0x34]
sub eax, edx
push ecx
mov edx, 0x237f
call fcn.0041d880
lea eax, [esp + 0x28]
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41db15
sub eax, edx
lea edx, [esp + 0x24]
push edx
mov edx, 0x237f
call fcn.0041d880
lea eax, [esp + 0x14]
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41db37
lea ecx, [esp + 0x10]
sub eax, edx
push ecx
mov edx, 0x237f
call fcn.0041d880
lea eax, [esp + 0x20]
add esp, 4
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41db60
sub eax, edx
lea edx, [esp + 0x1c]
push edx
mov edx, 0x237f
call fcn.0041d880
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueA]
add esp, 4
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x44]
push ecx
mov edi, 0x104
push 0x80000002
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], edi
call esi
test eax, eax
je 0x41dbd2
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x350]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x354
ret
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x44]
push eax
push 0x80000002
mov dword [esp + 0x20], edi
call esi
test eax, eax
jne 0x41dbb9
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x158]
push eax
mov ecx, edi
push 0x475820
lea edi, [esp + 0x264]
call fcn.00408e10
add esp, 0x10
test eax, eax
jl 0x41dbb9
mov ecx, edi
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov ecx, dword [esp + 0x358]
neg eax
pop edi
sbb eax, eax
pop esi
xor ecx, esp
neg eax
call fcn.0044b6ee
add esp, 0x354
ret
Function at 0x41ddb0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub esp, 0x354
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x350], eax
push esi
push edi
push 0x103
lea eax, [esp + 0x155]
push 0
push eax
mov byte [esp + 0x15c], 0
call fcn.0044e9d0
push 0x103
lea ecx, [esp + 0x5d]
push 0
push ecx
mov byte [esp + 0x64], 0
call fcn.0044e9d0
push 0x103
lea edx, [esp + 0x271]
push 0
push edx
mov byte [esp + 0x278], 0
call fcn.0044e9d0
mov eax, dword [0x475a00]
mov edx, dword [0x475a08]
mov ecx, 5
mov esi, 0x4759e8
lea edi, [esp + 0x58]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x475a04]
mov dword [esp + 0x48], eax
mov eax, dword [0x475a0c]
mov dword [esp + 0x54], eax
mov ax, word [0x4759cc]
mov dword [esp + 0x50], edx
mov edx, dword [0x4759c8]
mov dword [esp + 0x4c], ecx
mov ecx, dword [0x4759c4]
mov word [esp + 0x3c], ax
mov eax, dword [0x4759d4]
movsw word es:[edi], word [esi]
mov dword [esp + 0x38], edx
mov edx, dword [0x4759d0]
mov dword [esp + 0x34], ecx
mov cl, byte [0x4759ce]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x58]
mov dword [esp + 0x40], edx
add esp, 0x24
movsb byte es:[edi], byte [esi]
mov byte [esp + 0x1a], cl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41de93
lea ecx, [esp + 0x34]
sub eax, edx
push ecx
mov edx, 0x237f
call fcn.0041d880
lea eax, [esp + 0x28]
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41deb5
sub eax, edx
lea edx, [esp + 0x24]
push edx
mov edx, 0x237f
call fcn.0041d880
lea eax, [esp + 0x14]
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41ded7
lea ecx, [esp + 0x10]
sub eax, edx
push ecx
mov edx, 0x237f
call fcn.0041d880
lea eax, [esp + 0x20]
add esp, 4
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41df00
sub eax, edx
lea edx, [esp + 0x1c]
push edx
mov edx, 0x237f
call fcn.0041d880
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueA]
add esp, 4
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x44]
push ecx
mov edi, 0x104
push 0x80000002
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], edi
call esi
test eax, eax
je 0x41df72
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x350]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x354
ret
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x44]
push eax
push 0x80000002
mov dword [esp + 0x20], edi
call esi
test eax, eax
jne 0x41df59
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x158]
push eax
mov ecx, edi
push 0x475820
lea edi, [esp + 0x264]
call fcn.00408e10
add esp, 0x10
test eax, eax
jl 0x41df59
mov ecx, edi
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov ecx, dword [esp + 0x358]
neg eax
pop edi
sbb eax, eax
pop esi
xor ecx, esp
neg eax
call fcn.0044b6ee
add esp, 0x354
ret
Function at 0x41e150
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub esp, 0x35c
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x358], eax
push esi
push edi
push 0x103
lea eax, [esp + 0x15d]
push 0
push eax
mov byte [esp + 0x164], 0
call fcn.0044e9d0
push 0x103
lea ecx, [esp + 0x65]
push 0
push ecx
mov byte [esp + 0x6c], 0
call fcn.0044e9d0
push 0x103
lea edx, [esp + 0x279]
push 0
push edx
mov byte [esp + 0x280], 0
call fcn.0044e9d0
mov eax, dword [0x475a3c]
mov edx, dword [0x475a44]
mov dword [esp + 0x48], eax
mov eax, dword [0x475a48]
mov ecx, 7
mov esi, 0x475a20
lea edi, [esp + 0x5c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x475a40]
mov dword [esp + 0x4c], ecx
mov cl, byte [0x475a4c]
mov dword [esp + 0x54], eax
mov eax, dword [0x4759c8]
mov dword [esp + 0x50], edx
mov edx, dword [0x4759c4]
mov byte [esp + 0x58], cl
mov cx, word [0x4759cc]
mov dword [esp + 0x38], eax
mov eax, dword [0x4759d0]
mov dword [esp + 0x34], edx
mov dl, byte [0x4759ce]
mov word [esp + 0x3c], cx
mov ecx, dword [0x4759d4]
mov dword [esp + 0x40], eax
lea eax, [esp + 0x5c]
mov byte [esp + 0x3e], dl
add esp, 0x24
mov dword [esp + 0x20], ecx
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41e240
sub eax, edx
lea edx, [esp + 0x38]
push edx
mov edx, 0x237f
call fcn.0041d880
lea eax, [esp + 0x28]
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41e262
lea ecx, [esp + 0x24]
sub eax, edx
push ecx
mov edx, 0x237f
call fcn.0041d880
lea eax, [esp + 0x14]
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41e284
sub eax, edx
lea edx, [esp + 0x10]
push edx
mov edx, 0x237f
call fcn.0041d880
lea eax, [esp + 0x20]
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41e2a6
lea ecx, [esp + 0x1c]
sub eax, edx
push ecx
mov edx, 0x237f
call fcn.0041d880
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueA]
add esp, 4
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x15c]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x48]
push eax
mov edi, 0x104
push 0x80000002
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], edi
call esi
test eax, eax
je 0x41e318
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x358]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x35c
ret
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x58]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x48]
push edx
push 0x80000002
mov dword [esp + 0x20], edi
call esi
test eax, eax
jne 0x41e2ff
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x160]
push edx
mov ecx, edi
push 0x475820
lea edi, [esp + 0x26c]
call fcn.00408e10
add esp, 0x10
test eax, eax
jl 0x41e2ff
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov ecx, dword [esp + 0x360]
neg eax
pop edi
sbb eax, eax
pop esi
xor ecx, esp
neg eax
call fcn.0044b6ee
add esp, 0x35c
ret
Function at 0x41e600
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x210], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.0044e9d0
add esp, 0xc
lea edx, [esp + 4]
push edx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 8]
push ecx
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push 0x80000002
mov dword [esp + 0x1c], 0x208
mov dword [esp + 0x18], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x41e693
cmp word [esp + 8], ax
je 0x41e693
lea edx, [esp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
neg eax
sbb eax, eax
neg eax
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x214
ret
mov ecx, dword [esp + 0x210]
xor ecx, esp
xor eax, eax
call fcn.0044b6ee
add esp, 0x214
ret
Function at 0x41e7d0
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x46806b
mov eax, dword fs:[0]
push eax
sub esp, 0x644
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x640], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4832f0]
xor eax, esp
push eax
lea eax, [esp + 0x658]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x668]
xor edi, edi
mov dword [esp + 0x34], edi
mov esi, ecx
mov ebx, 7
xor eax, eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], edi
mov word [esp + 0x1c], ax
xor ecx, ecx
mov dword [esp + 0x660], edi
mov word [esp + 0x3c], cx
cmp ebp, edi
je 0x41e961
lea edx, [esp + 0x3c]
push edx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x41e961
mov eax, dword [0x475b40]
mov cx, word [0x475b44]
mov dword [esp + 0x34], eax
mov word [esp + 0x38], cx
lea ebx, [esp + 0x3c]
lea esp, [esp]
mov dx, word [ebx]
push 0x104
lea eax, [esp + 0x248]
push eax
lea ecx, [esp + 0x3c]
push ecx
mov word [esp + 0x40], dx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x41e935
lea eax, [esp + 0x244]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41e8b2
sub eax, edx
sar eax, 1
mov esi, eax
cmp esi, 0x104
jae 0x41e931
push esi
lea edx, [esp + 0x248]
push edx
push ebp
call fcn.0044dbc7
add esp, 0xc
mov edi, eax
neg edi
sbb edi, edi
add edi, 1
je 0x41e931
lea eax, [ebp + esi*2]
push eax
lea ecx, [esp + 0x38]
push ecx
push 0x475b48
lea edx, [esp + 0x458]
call fcn.0041ebc0
lea eax, [esp + 0x458]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41e910
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x450]
push edx
lea esi, [esp + 0x20]
call fcn.004018a0
mov esi, dword [esp + 0x14]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x41e935
test edi, edi
jne 0x41e94d
cmp word [ebx], di
jne 0x41e880
push 0xffffffffffffffff
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
push 0
jmp 0x41e96a
push 0xffffffffffffffff
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], edi
push edi
lea edx, [esp + 0x20]
xor ecx, ecx
push edx
mov eax, esi
mov word [esi + 4], cx
call fcn.00401950
cmp dword [esp + 0x30], 8
jb 0x41e990
mov eax, dword [esp + 0x1c]
push eax
call fcn.0044b6e3
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x658]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x640]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x650
ret
Function at 0x41e9c0
Capabilities:
Enumerate processes
Get process image filename

Disassembly:
push 0xffffffffffffffff
push 0x4685cb
mov eax, dword fs:[0]
push eax
sub esp, 0x45c
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x458], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4832f0]
xor eax, esp
push eax
lea eax, [esp + 0x470]
mov dword fs:[0], eax
push 0
push 2
mov dword [esp + 0x1c], 0
mov dword [esp + 0x3c], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [esp + 0x34]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x41eb78
lea ecx, [esp + 0x34]
push ecx
push edi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x41eb78
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ebp, [eax + 7]
lea edx, [esp + 0x58]
push str.explorer.exe
push edx
call fcn.0044b912
add esp, 8
test eax, eax
jne 0x41eb22
mov eax, dword [esp + 0x3c]
push eax
push 0
push 0x1fffff
call ebx
mov esi, eax
test esi, esi
je 0x41eb78
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x26e]
push edx
mov word [esp + 0x270], cx
call fcn.0044e9d0
add esp, 0xc
push 0x104
lea eax, [esp + 0x268]
push eax
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x41eb1b
lea ecx, [esp + 0x264]
push ecx
lea ecx, [esp + 0x1c]
call fcn.0041e7d0
add esp, 4
mov dword [esp + 0x478], 0
mov ecx, dword [esp + 0x1c]
cmp dword [esp + 0x30], ebp
jae 0x41eadd
lea ecx, [esp + 0x1c]
call fcn.00409530
test eax, eax
jne 0x41eb38
mov dword [esp + 0x478], 0xffffffff
cmp dword [esp + 0x30], ebp
jb 0x41eb04
mov edx, dword [esp + 0x1c]
push edx
call fcn.0044b6e3
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x34]
push ecx
push edi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x41ea47
jmp 0x41eb78
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [esp + 0x478], 0xffffffff
mov dword [esp + 0x14], eax
cmp dword [esp + 0x30], ebp
jb 0x41eb61
mov edx, dword [esp + 0x1c]
push edx
call fcn.0044b6e3
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x41eb8c
call fcn.0041e730
mov ecx, dword [esp + 0x470]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x458]
xor ecx, esp
call fcn.0044b6ee
add esp, 0x468
ret
Function at 0x41eca0
Capabilities:
Read file via mapping

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push 0
call fcn.0044d7d4
push eax
call fcn.0044dc6d
call fcn.0044dc7f
mov esi, eax
shl esi, 0x10
call fcn.0044dc7f
or eax, esi
cdq
mov ecx, 0x1869f
idiv ecx
lea edi, [ebx + 4]
push edx
push 0x47804c
push str.__s__d
call fcn.00403370
mov edi, dword [edi]
add esp, 0x14
push edi
push ebp
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebx + 8], eax
test eax, eax
je 0x41ed26
push 0
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebx + 0xc], eax
test eax, eax
je 0x41ed26
pop edi
pop esi
mov dword [ebx + 0x10], ebp
pop ebp
mov eax, 1
pop ebx
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
Function at 0x41f9a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
je 0x41f9f3
cmp dword [esi + 4], ebx
je 0x41f9f3
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
call fcn.0041ff00
cmp eax, ebx
je 0x41f9fc
cmp eax, 2
je 0x41f9f3
cmp eax, 0x3ee
jne 0x41f9fc
mov eax, dword [esi]
cmp eax, ebx
je 0x41f9e5
call fcn.00420690
cmp eax, ebx
jne 0x41f9fc
mov eax, dword [esi]
add eax, 0x618
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, esi
call fcn.0041fc90
test eax, eax
jne 0x41fa5c
mov eax, dword [esi]
call fcn.00420420
mov edi, eax
cmp edi, ebx
je 0x41fb3f
mov eax, dword [esi]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
add eax, 0x618
push eax
call fcn.00421940
mov edi, eax
add esp, 0xc
cmp edi, ebx
je 0x41fb3f
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov esi, dword [esi]
push ecx
push edx
add esi, 0x208
call fcn.004201b0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esi]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
add edx, 0x410
push edx
call fcn.00421940
mov edi, eax
add esp, 0xc
cmp edi, ebx
je 0x41fb3f
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov edi, dword [esi]
push ebx
push eax
add edi, 0x410
mov ecx, esi
call fcn.0041ff60
test eax, eax
je 0x41faf0
mov ecx, dword [esi + 4]
test byte [ecx], 1
jne 0x41fac2
mov eax, dword [esi]
test eax, eax
jne 0x41fab7
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00420690
mov edi, eax
test edi, edi
je 0x41fb3f
mov edx, dword [esi]
mov eax, dword [esi + 4]
push edx
push eax
call fcn.004204e0
mov edi, eax
test edi, edi
je 0x41fb3f
mov ecx, dword [esp + 0x10]
mov esi, dword [esi]
push ebx
push ecx
add esi, 0x208
call fcn.004201b0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
call fcn.00420420
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x41fb3f
mov ecx, dword [esi]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
add ecx, 0x618
push ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.00421940
mov edi, eax
add esp, 0xc
cmp edi, ebx
je 0x41fb3f
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov esi, dword [esi]
push edx
push eax
add esi, 0x208
call fcn.004201b0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41fb50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x214
mov eax, dword [0x4832f0]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
mov ebx, dword [esp + 0x21c]
mov eax, dword [ebx]
test eax, eax
je 0x41fc70
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add eax, 0x410
push eax
call ebp
cmp eax, 0xffffffff
je 0x41fc6f
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1e]
push ecx
mov word [esp + 0x20], ax
call fcn.0044e9d0
mov ecx, dword [ebx]
add esp, 0xc
add ecx, 0x208
lea edi, [esp + 0x14]
call fcn.00420bc0
pop edi
test eax, eax
jne 0x41fc6f
mov ecx, 0x104
lea eax, [esp + 0x10]
lea esp, [esp]
cmp word [eax], 0
je 0x41fbe3
add eax, 2
sub ecx, 1
jne 0x41fbd0
jmp 0x41fc6f
test ecx, ecx
je 0x41fc6f
mov eax, 0x104
sub eax, ecx
push 0x7fffffff
mov ecx, 0x104
push str..sys
sub ecx, eax
lea edx, [esp + eax*2 + 0x18]
call fcn.00402f40
test eax, eax
jl 0x41fc6f
push esi
mov esi, dword [ebx]
add esi, 0x208
call fcn.00420cc0
mov edx, dword [ebx]
add edx, 0x618
push edx
call ebp
cmp eax, 0xffffffff
je 0x41fc6e
mov edx, dword [ebx]
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
add edx, 0x618
push edx
call fcn.00421940
add esp, 0xc
test eax, eax
je 0x41fc6e
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov esi, dword [ebx]
push eax
push ecx
add esi, 0x208
call fcn.004201b0
pop esi
pop ebp
mov ecx, dword [esp + 0x214]
pop ebx
xor ecx, esp
call fcn.0044b6ee
add esp, 0x214
ret 4

Function at 0x41ff00
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [esi]
test eax, eax
jne 0x41ff0c
mov eax, 2
ret
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add eax, 0x618
push eax
call edi
test eax, eax
jne 0x41ff37
mov eax, dword [esi]
add eax, 0x410
push eax
call edi
neg eax
sbb eax, eax
and eax, 0x3ec
add eax, 2
pop edi
ret
mov edi, dword [esi]
add edi, 0x618
push 0x4dfa00
call fcn.00403570
neg eax
sbb eax, eax
and eax, 0xfffffc12
add eax, 0x3ee
pop edi
ret