joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ea5e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi + 0xc]
push ebx
push 0
lea ecx, [ebp + 8]
push ecx
push 0x7f90
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 8]
mov edx, dword [esi + 0xc]
xor ebx, ebx
shr ecx, 1
mov word [edx + ecx*2], bx
pop ebx
test eax, eax
je 0x46eab4
cmp dword [ebp + 8], 0
je 0x46eab4
push dword [esi + 0xc]
lea eax, [ebp - 4]
push eax
call fcn.00405d14
lea eax, [ebp - 4]
push eax
push edi
call fcn.0041f17d
lea ecx, [ebp - 4]
call fcn.004058a3
jmp 0x46eabb
mov ecx, edi
call fcn.0040932c
mov eax, edi
leave
ret 4

Function at 0x46eac1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0xffffffff
push edi
mov edi, eax
jne 0x46ead6
mov ecx, edi
call fcn.0040932c
jmp 0x46eafd
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push 0
lea edx, [ebp + 0xc]
push edx
add ecx, ecx
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x46eacd
push dword [ebp + 8]
call fcn.0046ea5e
mov eax, edi
pop edi
pop ebp
ret 8

Function at 0x46ef10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, ecx
push edi
xor esi, esi
mov edi, eax
mov dword [ebx + 0x10], edi
cmp dword [ebx + 4], esi
je 0x46ef9d
cmp edi, esi
je 0x46ef48
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push eax
lea esi, [ebx + 0x14]
call fcn.0041261a
push dword [ebx + 0x14]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x20]
xor esi, esi
lea eax, [ebp - 4]
push eax
push esi
push ebx
push 0x46efa4
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
cmp edi, esi
je 0x46ef68
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x46ef92
mov edi, dword [ebp - 4]
cmp ebx, esi
je 0x46ef8e
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x46ef9f
cmp ebx, esi
je 0x46ef9d
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x46f4a1
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x2e
mov esi, ebx
mov edi, eax
call fcn.00438f27
test eax, eax
jg 0x46f4c3
mov al, 1
jmp 0x46f5fd
lea ecx, [ebp - 8]
push ecx
push ebx
mov ecx, eax
call fcn.0042e143
lea ecx, [ebp - 0x14]
call fcn.0040932c
push dword [ebp - 8]
mov eax, dword [ebp + 0xc]
push dword [ebx]
push dword [eax]
lea eax, [ebp - 0x14]
push str.__verbose___log_file__s____remove_pack_file___s____s_
push eax
call fcn.0043e898
add esp, 0x14
cmp dword [edi + 0x10], 0
je 0x46f501
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
push 0
push 0x8000008
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [edi + 0xc]
push eax
call fcn.0045f649
add esp, 0x14
lea esi, [ebp - 8]
mov byte [ebp - 1], 1
call fcn.00450540
test al, al
je 0x46f539
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x46f5ce
lea ecx, [ebp - 0x10]
call fcn.0040932c
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.0045fcd5
pop ecx
lea ecx, [ebp - 0xc]
call fcn.0040932c
push 0xca
lea esi, [ebp - 0x18]
call fcn.0046ddc0
mov eax, dword [ebp - 8]
mov ebx, dword [eax - 0xc]
mov eax, dword [ebp - 0x18]
pop ecx
push 0x5c
lea esi, [ebp - 8]
mov dword [ebp - 0x1c], eax
call fcn.00438f27
mov ecx, ebx
sub ecx, eax
lea eax, [ebp - 0x20]
push eax
mov eax, esi
push eax
call fcn.0042e0e7
push dword [ebp - 0x10]
push dword [eax]
lea eax, [ebp - 0xc]
push dword [ebp - 0x1c]
push eax
call fcn.0043e898
add esp, 0x10
lea ecx, [ebp - 0x20]
call fcn.004058a3
push 0
lea esi, [ebp - 0xc]
call fcn.00465c14
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 1], 0
call fcn.004058a3
mov ecx, esi
call fcn.004058a3
lea ecx, [ebp - 0x10]
call fcn.004058a3
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [edi + 0x10], 0
je 0x46f5ea
mov edi, dword [edi + 0x10]
mov eax, dword [edi]
push ebx
mov ecx, edi
call dword [eax + 0x18]
lea ecx, [ebp - 0x14]
call fcn.004058a3
lea ecx, [ebp - 8]
call fcn.004058a3
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x46f742
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [edi + 0x10], eax
cmp dword [eax], ebx
je 0x46f775
push ebx
push ebx
push ebx
push ebx
lea esi, [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push eax
call fcn.0041261a
mov eax, dword [edi + 0x10]
mov ecx, dword [eax]
push dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x10]
lea eax, [ebp - 4]
push eax
push ebx
push edi
push 0x46f995
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x18], esi
cmp dword [eax], ebx
je 0x46f7c9
call fcn.0046f805
mov ebx, dword [edi + 4]
mov esi, eax
mov eax, dword [edi]
mov dword [ebp - 0xc], edx
call fcn.0045cda8
add esi, eax
adc dword [ebp - 0xc], edx
mov eax, dword [edi + 0x10]
push dword [ebp - 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
push esi
call dword [eax]
mov eax, dword [edi + 0x10]
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 8]
mov esi, dword [ebp - 0x18]
xor ebx, ebx
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x46f7f3
mov edi, dword [ebp - 4]
cmp esi, ebx
je 0x46f7ef
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x46f800
cmp esi, ebx
je 0x46f7fe
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x46fd5c
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push edi
push 0x3c
xor edi, edi
lea eax, [ebp - 0x3c]
push edi
push eax
call fcn.0049cb00
mov eax, dword [ebp + 8]
mov eax, dword [eax]
add esp, 0xc
lea ecx, [ebp - 0x3c]
push ecx
push edi
push edi
push eax
mov dword [ebp - 0x28], 0x64
mov dword [ebp - 0x3c], 0x3c
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x46fda1
mov ecx, ebx
call fcn.0040932c
jmp 0x46fdae
push dword [ebp - 0x2c]
mov edi, dword [ebp - 0x28]
mov eax, ebx
call fcn.004601c1
mov eax, ebx
pop edi
leave
ret

Function at 0x470191
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
lea esi, [edi + 4]
push dword [esi]
call fcn.0046fc92
pop ecx
push esi
call fcn.00410db8
mov eax, dword [edi + 0x28]
push dword [eax]
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [esi]
call ebx
lea ecx, [ebp - 4]
call fcn.0040932c
push 0xdc
lea eax, [ebp - 4]
push eax
call fcn.00405a81
push 0x40a
push dword [esi]
call dword [sym.imp.USER32.dll_GetDlgItem]
push dword [ebp - 4]
push eax
call ebx
lea eax, [edi + 0x40]
push eax
mov eax, dword [esi]
call fcn.004727b3
push dword [esi]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
push edi
push 0x47025f
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [ebp - 4]
mov dword [edi + 0x30], eax
call fcn.004058a3
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x47039d
Capabilities:
Get session user name
List groups for user account

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x501344]
xor eax, ebp
mov dword [ebp + 0x198], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x6c]
xor ebx, ebx
push eax
mov dword [ebp - 0x78], ebx
call esi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x6c]
push eax
call esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00405d14
push str.SYSTEM
lea eax, [ebp - 0x70]
push eax
call fcn.0045bf87
test eax, eax
jne 0x470404
lea ecx, [ebp - 0x70]
call fcn.004058a3
mov al, 1
jmp 0x47045d
push edi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x7c]
push eax
push 1
push ebx
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], ebx
push ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x80], ebx
call sub.NETAPI32.dll_NetUserGetLocalGroups
test eax, eax
jne 0x470452
mov esi, dword [ebp - 0x7c]
xor edi, edi
cmp dword [ebp - 0x74], ebx
jbe 0x470452
cmp esi, ebx
je 0x470445
mov ecx, dword [esi]
call fcn.0044eb70
test eax, eax
je 0x470450
add esi, 4
inc edi
cmp edi, dword [ebp - 0x74]
jb 0x470436
jmp 0x470452
mov bl, 1
lea ecx, [ebp - 0x70]
call fcn.004058a3
mov al, bl
pop edi
mov ecx, dword [ebp + 0x198]
pop esi
xor ecx, ebp
pop ebx
call fcn.0049c07b
add ebp, 0x19c
leave
ret

Function at 0x470682
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [eax]
sub esp, 0x1c
push SysReAllocStringLen
push eax
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
jne 0x4706a3
xor al, al
jmp 0x4706c0
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x47069f
cmp dword [ebp - 0x18], 4
je 0x4706be
cmp dword [ebp - 0x18], 2
jne 0x47069f
mov al, 1
leave
ret 4
Function at 0x471391
Capabilities:
Create process on windows
Query service status
Start service

Disassembly:
push ebp
lea ebp, [esp - 0x304]
sub esp, 0x384
mov eax, dword [0x501344]
xor eax, ebp
mov dword [ebp + 0x300], eax
push esi
push edi
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0xc], 1
jne 0x47145c
push 0x4e13c0
push str.SAGEWINDOWCLASS
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x4713e4
xor eax, eax
jmp 0x4714bf
push 0x44
pop esi
push esi
xor edi, edi
lea eax, [ebp - 0x80]
push edi
push eax
call fcn.0049cb00
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0xf8]
push eax
push 0x104
push edi
push str.mstask.exe
push edi
mov dword [ebp - 0x80], esi
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x471426
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4714bf
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x80]
push eax
push edi
push edi
push 0x210
push edi
push edi
push edi
push edi
lea eax, [ebp + 0xf8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x47141b
push dword [ebp - 0x30]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x2c]
call esi
jmp 0x4713dd
push 1
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
cmp esi, edi
je 0x47141b
push ebx
push 0x14
push str.Schedule
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
call esi
cmp ebx, edi
je 0x4714b1
lea eax, [ebp - 0x3c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4714ae
cmp dword [ebp - 0x38], 4
je 0x4714b9
push edi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x4714b9
push ebx
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4714be
push ebx
call esi
xor eax, eax
pop ebx
mov ecx, dword [ebp + 0x300]
pop edi
xor ecx, ebp
pop esi
call fcn.0049c07b
add ebp, 0x304
leave
ret
Function at 0x471a8d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, eax
test edi, edi
je 0x471aa1
add edi, 0xffffffc0
jmp 0x471aa3
xor edi, edi
push dword [ebp + 8]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push dword [edi + 4]
mov dword [ebp - 0xc], 1
call ebx
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
or dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], eax
push eax
mov eax, dword [ebp + 0xc]
call fcn.0041eea0
test eax, eax
je 0x471af0
mov ecx, dword [ebp - 4]
inc ecx
push ecx
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
or eax, 0xffffffff
call fcn.004092df
mov eax, dword [ebp - 4]
cmp dword [ebp - 8], eax
jge 0x471b21
and dword [ebp - 0xc], 0
push 0xffffffffffffffff
add edi, 0x40
call dword [sym.imp.USER32.dll_MessageBeep]
test edi, edi
je 0x471b10
lea eax, [edi - 0x40]
jmp 0x471b12
xor eax, eax
push dword [ebp + 8]
push dword [eax + 4]
call ebx
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x472494
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push esi
call fcn.0045fdcb
test eax, eax
je 0x472531
lea eax, [esp + 8]
push eax
xor esi, esi
push 0x28
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4724e1
cmp dword [esp + 8], esi
je 0x4724dd
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x472548
lea eax, [esp + 0x14]
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push esi
push esi
push esi
lea eax, [esp + 0x1c]
push eax
push esi
push dword [esp + 0x1c]
mov dword [esp + 0x28], 1
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4724cd
cmp dword [esp + 8], esi
je 0x472536
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x472536
call fcn.0047254d
push 0x80040002
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
setne al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x47254d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x501344]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
push str.CreateToolhelp32Snapshot
push ebx
call esi
test eax, eax
je 0x47268c
push 0
push 2
call eax
mov dword [ebp - 0x248], eax
cmp eax, 0xffffffff
jne 0x4725a3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x47268c
push str._WindowsFolder_explorer.exe
lea eax, [ebp - 0x23c]
push eax
call fcn.00405d14
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x23c]
call fcn.00465335
pop ecx
lea ecx, [ebp - 0x23c]
call fcn.004058a3
push str.Process32FirstW
push ebx
call esi
push str.Process32NextW
push ebx
mov edi, eax
call esi
push 0x228
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x234]
push 0
push eax
call fcn.0049cb00
add esp, 0xc
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x248]
mov dword [ebp - 0x238], 0x22c
call edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x47266c
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.0045bf87
test eax, eax
jne 0x472659
push dword [ebp - 0x230]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test esi, esi
je 0x472659
push esi
call edi
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x248]
call dword [ebp - 0x23c]
test eax, eax
jne 0x472621
lea ecx, [ebp - 0x240]
call fcn.004058a3
cmp dword [ebp - 0x248], 0
je 0x47268c
push dword [ebp - 0x248]
call edi
test ebx, ebx
je 0x472697
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049c07b
leave
ret
Function at 0x4747d3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0x7c]
mov eax, dword [eax + 0xc]
push edi
mov edi, dword [eax + 8]
xor ebx, ebx
cmp edi, ebx
mov dword [esp + 0xc], ebx
jle 0x47481b
mov eax, dword [esi + 0x7c]
push ebx
call fcn.004688ba
cmp eax, 5
je 0x474807
cmp eax, 2
jne 0x47480b
inc dword [esp + 0xc]
inc ebx
cmp ebx, edi
jl 0x4747f4
cmp dword [esp + 0xc], 0
jg 0x4748ae
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3f7
push dword [esi + 4]
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call ebx
push 0x3eb
push dword [esi + 4]
call edi
push 0
push eax
mov dword [esp + 0x14], eax
call ebx
push 0x3ec
push dword [esi + 4]
call edi
xor edi, edi
push edi
push eax
call ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0x10]
push eax
sub esi, 0xffffff80
push dword [esi]
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
call ebx
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x10]
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
call ebx
mov eax, dword [esp + 0x2c]
push 0x222
push edi
mov dword [esp + 0x24], eax
push esi
lea eax, [esp + 0x1c]
call fcn.00410cce
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x476dd5
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea ecx, [ebp - 0x14]
call fcn.0040932c
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x80]
mov ecx, dword [eax + 0xc]
mov esi, dword [ebp + 0x10]
mov eax, dword [esi + 0x10]
add ecx, 4
call fcn.0045bfad
add eax, 0x24
push eax
lea eax, [ebp - 8]
push eax
call fcn.0041f17d
mov eax, dword [ebp - 8]
cmp dword [eax - 0xc], 0
je 0x476f20
push dword [edi + 0x84]
lea eax, [ebp - 4]
push eax
call fcn.0041f17d
lea eax, [ebp - 4]
call fcn.0044f3f0
mov eax, dword [esi + 0x14]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 4]
call fcn.004390fc
lea eax, [ebp - 4]
call fcn.0044f3f0
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.0046fdd2
mov eax, dword [eax]
pop ecx
push dword [eax - 0xc]
push eax
lea eax, [ebp - 4]
call fcn.004390fc
lea ecx, [ebp - 0x10]
call fcn.004058a3
xor bl, bl
mov esi, edi
call fcn.00476fce
push 0x8a
lea esi, [ebp - 0xc]
call fcn.0046ddc0
pop ecx
push dword [ebp - 0xc]
push 2
push dword [edi + 0xf4]
push dword [ebp + 0xc]
call fcn.0042a9fb
mov ecx, dword [ebp - 4]
push 0
push dword [ebp - 8]
call fcn.0046e448
mov bl, al
pop ecx
pop ecx
test bl, bl
jne 0x476f0c
cmp byte [0x505028], al
je 0x476ed8
push str.MD5_of_downloaded_file_is_invalid.
lea eax, [ebp - 0x10]
push eax
call fcn.00465a6a
push eax
call fcn.00465a7a
push eax
mov eax, 0x504ff8
call fcn.00464e5b
lea ecx, [ebp - 0x10]
call fcn.004058a3
lea esi, [ebp - 4]
call fcn.0040d2f8
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x5c
call fcn.00438f27
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
push ecx
mov ecx, eax
call fcn.0042e143
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [ebp - 0x10]
call fcn.004058a3
lea ecx, [ebp - 0xc]
call fcn.004058a3
lea ecx, [ebp - 4]
call fcn.004058a3
test bl, bl
je 0x476f49
push dword [edi + 0xf4]
push dword [ebp + 0xc]
call fcn.0042b316
mov ecx, dword [edi + 0x80]
mov ecx, dword [ecx + 0xc]
add ecx, 4
call fcn.0045bfad
mov byte [eax + 0x68], 1
mov byte [ebp + 0xf], 1
jmp 0x476fa2
inc dword [edi + 0x188]
lea ecx, [ebp - 4]
call fcn.0040932c
push 0x8b
lea esi, [ebp - 0x10]
call fcn.0046ddc0
pop ecx
lea edi, [ebp - 4]
call fcn.00438ebc
mov ecx, esi
call fcn.004058a3
push dword [ebp - 4]
mov eax, dword [ebp + 8]
push 2
push dword [eax + 0xf4]
push dword [ebp + 0xc]
call fcn.0042a9fb
mov eax, dword [ebp + 0x10]
mov ecx, edi
mov dword [eax + 0xc], 1
mov byte [ebp + 0xf], 0
call fcn.004058a3
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 8]
cmp dword [eax - 0xc], 0
je 0x476fb4
mov bl, 1
mov esi, edi
call fcn.00476fce
lea ecx, [ebp - 8]
call fcn.004058a3
lea ecx, [ebp - 0x14]
call fcn.004058a3
mov al, byte [ebp + 0xf]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4785ad
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebx + 0x74]
push edi
call fcn.0046a180
mov eax, dword [ebx + 0x74]
xor esi, esi
push esi
push 0x3025
call fcn.0046a219
mov eax, dword [ebx + 0x74]
push esi
push 0x3023
call fcn.0046a219
mov eax, dword [ebx + 0x74]
push esi
push 0x3024
call fcn.0046a219
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x401
push dword [ebx + 4]
call edi
push 1
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0x7f04
push ebx
call fcn.0047894d
push ebx
call fcn.004786c7
mov dword [ebx + 0x88], esi
push 0
lea esi, [ebx + 0x80]
push dword [esi]
call fcn.004692a4
test eax, eax
jne 0x478691
mov esi, dword [esi]
add esi, 0x3c
lea eax, [ebx + 0x7c]
mov byte [esi + 0x19], 0
mov byte [esi + 0x18], 0
mov dword [esi + 0x10], eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [esi + 0x1c], eax
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push esi
push 0x472177
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xae
lea esi, [ebp - 4]
call fcn.0046ddc0
pop ecx
mov edi, eax
call fcn.00478cdc
mov ecx, esi
mov dword [ebx + 0x94], eax
call fcn.004058a3
push 0
push 0x3e8
push 1
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x4786c1
mov eax, dword [ebx + 0x74]
mov esi, dword [sym.imp.USER32.dll_GetParent]
mov byte [eax + 0x85], 1
push dword [ebx + 4]
call esi
push 2
push eax
call edi
push dword [ebx + 4]
mov edi, eax
call esi
push edi
push 2
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
xor eax, eax
pop esi
leave
ret

Function at 0x4793c6
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x501344]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
push ebx
push edi
mov edi, ecx
jne 0x479404
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x210]
push eax
push esi
call fcn.00405cf1
lea ecx, [ebp - 0x214]
call fcn.0040932c
mov eax, edi
lea edi, [ebp - 0x214]
call fcn.00438ebc
lea eax, [ebp - 0x218]
push eax
xor ecx, ecx
push esi
inc ecx
call fcn.0042e0e7
mov edi, 0x4d8c20
push edi
push eax
call fcn.0042e27d
test eax, eax
lea ecx, [ebp - 0x218]
setne bl
call fcn.004058a3
test bl, bl
je 0x479453
push edi
push esi
call fcn.00439083
push str.AI_WSP_
push esi
call fcn.00439083
mov eax, dword [ebp - 0x214]
push dword [eax - 0xc]
push eax
mov eax, esi
call fcn.004390fc
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x214]
call fcn.004058a3
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0049c07b
leave
ret