joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45add5
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x7286bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x70]
push edi
xor edi, edi
push edi
call fcn.0042c05a
push edi
lea ecx, [ebp - 0x58]
call fcn.0042c05a
push edi
lea ecx, [ebp - 0x58]
call fcn.0042ee2b
mov eax, dword [ebp + 0x10]
mov ebx, edi
sub eax, dword [ebp + 0xc]
sar eax, 4
test eax, eax
je 0x45af06
push 0
lea ecx, [ebp - 0x34]
call fcn.0042c05a
mov eax, dword [ebp + 0xc]
push 0xfde9
push dword [edi + eax]
call fcn.00507e2a
sub esp, 0x10
mov ecx, esp
push eax
call fcn.0042c02e
push str.areacode
lea ecx, [ebp - 0x34]
call fcn.0042c66e
mov ecx, eax
call fcn.0042c2d9
mov eax, dword [ebp + 0xc]
push 0xfde9
push dword [edi + eax + 4]
call fcn.00507e2a
sub esp, 0x10
mov ecx, esp
push eax
call fcn.0042c02e
push str.area
lea ecx, [ebp - 0x34]
call fcn.0042c66e
mov ecx, eax
call fcn.0042c2d9
mov eax, dword [ebp + 0xc]
push 0xfde9
push dword [edi + eax + 8]
call fcn.00507e2a
sub esp, 0x10
mov ecx, esp
push eax
call fcn.0042c02e
push str.city
lea ecx, [ebp - 0x34]
call fcn.0042c66e
mov ecx, eax
call fcn.0042c2d9
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov ecx, esp
movzx eax, byte [edi + eax + 0xc]
push eax
call fcn.0042c10f
push str.selected
lea ecx, [ebp - 0x34]
call fcn.0042c66e
mov ecx, eax
call fcn.0042c2d9
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x58]
call fcn.0042d0f8
lea ecx, [ebp - 0x34]
call fcn.0042c25f
mov eax, dword [ebp + 0x10]
lea edi, [edi + 0x10]
sub eax, dword [ebp + 0xc]
inc ebx
sar eax, 4
cmp ebx, eax
jb 0x45ae1b
xor edi, edi
sub esp, 0x18
lea eax, [ebp - 0x58]
mov ecx, esp
push eax
call fcn.0042be2a
push str.weatherCitys
lea ecx, [ebp - 0x70]
call fcn.0042c66e
mov ecx, eax
call fcn.0042c2d9
lea ecx, [ebp - 0x3c]
call fcn.0042f8e5
lea ecx, [ebp - 0x70]
push ecx
lea ecx, [ebp - 0x1c]
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 4]
lea ecx, [ebp - 0x3c]
call fcn.0042fa2a
push 1
push edi
lea eax, [ebp - 0x40]
mov byte [ebp - 0x40], 0xa
push eax
lea ecx, [ebp - 0x1c]
call fcn.0041fe15
cmp eax, 0xffffffff
je 0x45af6a
push 1
push eax
lea ecx, [ebp - 0x1c]
call fcn.0041fd9c
cmp dword [ebp - 8], 0x10
lea eax, [ebp - 0x1c]
push 0xfde9
cmovae eax, dword [ebp - 0x1c]
push eax
push esi
call fcn.004b2a76
add esp, 0xc
lea ecx, [ebp - 0x1c]
push edi
push 1
call fcn.0041f932
lea ecx, [ebp - 0x58]
call fcn.0042c25f
lea ecx, [ebp - 0x70]
call fcn.0042c25f
lea ecx, [ebp + 0xc]
call fcn.0050ed8e
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00609802
mov esp, ebp
pop ebp
ret
Function at 0x45bfed
Capabilities:
Check if file exists
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
lea ecx, [ebp - 0x20]
call fcn.00417833
push ecx
mov ecx, esp
mov ebx, str.rmup.exe
push ebx
call fcn.004177e7
push ecx
mov esi, esp
push ecx
push esp
lea ecx, [ebp - 0x20]
call fcn.00418c45
push esi
lea ecx, [ebp - 0x20]
call fcn.00419083
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.0041934b
push ecx
mov ecx, esp
push str.MyTime
call fcn.004177e7
push ecx
push esp
lea ecx, [ebp - 0x20]
call fcn.00454cc3
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x20]
call fcn.0041934b
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x45c079
push ecx
lea eax, [esi - 0x10]
mov edi, esp
push eax
call fcn.00418dea
pop ecx
add eax, 0x10
lea ecx, [ebp - 0x20]
mov dword [edi], eax
call fcn.0045f16a
push ecx
mov ecx, esp
push ebx
call fcn.004177e7
push ecx
lea ebx, [esi - 0x10]
mov edi, esp
push ebx
call fcn.00418dea
add eax, 0x10
pop ecx
mov dword [edi], eax
lea ecx, [ebp - 0x20]
lea eax, [ebp - 4]
push eax
call fcn.0041934b
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, dword [ebp - 8]
test eax, eax
jne 0x45c0bb
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [esi - 0x10]
call fcn.00419521
mov ecx, ebx
call fcn.00419521
lea ecx, [edi - 0x10]
call fcn.00419521
lea ecx, [ebp - 0x20]
call fcn.00418dd0
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00419521
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45db41
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x7286bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, ecx
push edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], eax
push ecx
push dword [eax - 0x14]
xorps xmm0, xmm0
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
push str.WkeBrowser
push esi
call fcn.0063cf0b
pop ecx
pop ecx
test eax, eax
jne 0x45dc42
xor ebx, ebx
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.00483010
pop ecx
pop ecx
push dword [ebp - 0x1c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45dc08
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
push ecx
mov eax, dword [eax + 0x2a8]
sub eax, 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, esp
push eax
call fcn.00418dea
sub esp, 0xc
add eax, 0x10
mov dword [esi], eax
mov edi, esp
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
lea ecx, [eax + 0x2c0]
mov dword [ebp - 0x18], ecx
lea ecx, [eax - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.005c0f42
mov esi, dword [ebp - 0x18]
mov ecx, esi
push eax
call fcn.0045d677
push 0x1c8
call fcn.00609934
pop ecx
test eax, eax
je 0x45dc33
push esi
mov ecx, eax
call fcn.00441b7e
jmp 0x45dc31
push ebx
push ebx
push 0x583
push dword [0x735624]
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x1c0
call fcn.00609934
pop ecx
test eax, eax
je 0x45dc33
mov ecx, eax
call fcn.005d6b9e
mov ebx, eax
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov eax, ebx
jmp 0x45dc7f
push str.ButtonHorizontalLayout
push esi
call fcn.0063cf0b
pop ecx
pop ecx
test eax, eax
jne 0x45dc78
push 0x368
call fcn.00609934
pop ecx
test eax, eax
je 0x45dc6b
mov ecx, eax
call fcn.00440fef
jmp 0x45dc6d
xor eax, eax
lea ecx, [eax + 8]
neg eax
sbb eax, eax
and eax, ecx
jmp 0x45dc7f
push esi
call fcn.0045ee47
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00609802
mov esp, ebp
pop ebp
ret 4
Function at 0x45dcd2
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x7286bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14]
mov esi, ecx
xorps xmm0, xmm0
push eax
mov dword [ebp - 0x18], esi
movups xmmword [ebp - 0x14], xmm0
push dword [esi - 0x14]
call dword [sym.imp.USER32.dll_GetWindowRect]
push str.WkeBrowser
push edi
call fcn.0063cf0b
pop ecx
pop ecx
test eax, eax
jne 0x45de00
xor ebx, ebx
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.00483010
pop ecx
pop ecx
push dword [ebp - 0x1c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45ddd3
mov byte [esi + 0x2b4], 1
lea edi, [ebp - 0x2c]
mov eax, dword [0x735fbc]
lea esi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
mov edx, str.https:__my.ruanmei.com_wechat_applogin.html
push ecx
mov ecx, esp
cmp dword [eax - 0xc], ebx
movsd dword es:[edi], dword [esi]
cmovne edx, eax
push edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004177e7
sub esp, 0x10
lea esi, [ebp - 0x2c]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x18]
lea ecx, [esi - 0x18]
call fcn.005c0f42
lea edi, [esi + 0x2a8]
push eax
mov ecx, edi
call fcn.0045d677
push ebx
push 0x64
lea ecx, [esi + 8]
call fcn.005d30ce
mov ecx, dword [edi]
test ecx, ecx
je 0x45ddba
movd xmm0, eax
cvtdq2pd xmm0, xmm0
push ecx
divsd xmm0, qword [0x6c2718]
cvtpd2ps xmm0, xmm0
movss dword [esp], xmm0
push dword [ecx + 4]
call dword [0x73667c]
pop ecx
pop ecx
push 0x1c8
call fcn.00609934
pop ecx
test eax, eax
je 0x45ddf1
push edi
mov ecx, eax
call fcn.00441b7e
jmp 0x45ddef
push 0x1c0
mov byte [esi + 0x2b4], bl
call fcn.00609934
pop ecx
test eax, eax
je 0x45ddf1
mov ecx, eax
call fcn.005d6b9e
mov ebx, eax
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov eax, ebx
jmp 0x45de07
push edi
call fcn.0045ee47
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00609802
mov esp, ebp
pop ebp
ret 4
Function at 0x45ece6
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x7286bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, ecx
push edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], eax
push ecx
push dword [eax - 0x14]
xorps xmm0, xmm0
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
push str.WkeBrowser
push esi
call fcn.0063cf0b
pop ecx
pop ecx
test eax, eax
jne 0x45ede7
xor ebx, ebx
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.00483010
pop ecx
pop ecx
push dword [ebp - 0x1c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45edad
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
push ecx
mov eax, dword [eax + 0x2a8]
sub eax, 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, esp
push eax
call fcn.00418dea
sub esp, 0xc
add eax, 0x10
mov dword [esi], eax
mov edi, esp
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
lea ecx, [eax + 0x2b8]
mov dword [ebp - 0x18], ecx
lea ecx, [eax - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.005c0f42
mov esi, dword [ebp - 0x18]
mov ecx, esi
push eax
call fcn.0045d677
push 0x1c8
call fcn.00609934
pop ecx
test eax, eax
je 0x45edd8
push esi
mov ecx, eax
call fcn.00441b7e
jmp 0x45edd6
push ebx
push ebx
push 0x583
push dword [0x735624]
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x1c0
call fcn.00609934
pop ecx
test eax, eax
je 0x45edd8
mov ecx, eax
call fcn.005d6b9e
mov ebx, eax
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov eax, ebx
jmp 0x45ee24
push str.ButtonHorizontalLayout
push esi
call fcn.0063cf0b
pop ecx
pop ecx
test eax, eax
jne 0x45ee1d
push 0x368
call fcn.00609934
pop ecx
test eax, eax
je 0x45ee10
mov ecx, eax
call fcn.00440fef
jmp 0x45ee12
xor eax, eax
lea ecx, [eax + 8]
neg eax
sbb eax, eax
and eax, ecx
jmp 0x45ee24
push esi
call fcn.0045ee47
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00609802
mov esp, ebp
pop ebp
ret 4
Function at 0x45f16a
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, ecx
mov dword [ebp - 8], ebx
call edi
test eax, eax
jne 0x45f1eb
mov eax, dword [ebp + 8]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
call fcn.00418dea
add eax, 0x10
pop ecx
mov dword [esi], eax
mov ecx, ebx
lea eax, [ebp - 4]
push eax
call fcn.00419083
mov esi, dword [ebp - 4]
push esi
call edi
xor ebx, ebx
test eax, eax
jne 0x45f1d0
push ecx
lea eax, [esi - 0x10]
mov edi, esp
push eax
call fcn.00418dea
pop ecx
mov ecx, dword [ebp - 8]
add eax, 0x10
mov dword [edi], eax
call fcn.0045f16a
test eax, eax
je 0x45f1e1
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x45f1e1
xor ebx, ebx
inc ebx
lea ecx, [esi - 0x10]
call fcn.00419521
jmp 0x45f1ed
xor ebx, ebx
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00419521
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45f467
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
mov eax, dword [0x7286bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
call fcn.00484028
xor ebx, ebx
xorps xmm0, xmm0
cmp eax, 0x13
jge 0x45f4e6
push 0x44
lea eax, [ebp - 0xa4]
push ebx
push eax
movups xmmword [ebp - 0x50], xmm0
call fcn.0060b7a0
mov eax, dword [ebp + 8]
add esp, 0xc
cmp dword [eax - 4], 1
jle 0x45f4b8
push dword [eax - 0xc]
lea ecx, [ebp + 8]
call fcn.00418f15
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0xa4]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0x50]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, eax
call esi
push dword [ebp - 0x4c]
jmp 0x45f5e1
push edi
push 6
pop ecx
mov esi, str.S_1_16_8192
mov dword [ebp - 0x38], ebx
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x30], ebx
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov dword [ebp - 0x34], ebx
lea edi, [ebp - 0x14]
mov dword [ebp - 0x40], ebx
stosd dword es:[edi], eax
push 0x44
push ebx
mov dword [ebp - 0x3c], ebx
stosd dword es:[edi], eax
movups xmmword [ebp - 0x60], xmm0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0060b7a0
add esp, 0xc
lea eax, [ebp - 0x38]
mov esi, 0x2000000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
pop edi
test eax, eax
je 0x45f5e3
lea eax, [ebp - 0x30]
push eax
push 1
push 2
push ebx
push esi
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x45f5de
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
je 0x45f5d9
mov eax, dword [ebp - 0x34]
push eax
mov dword [ebp - 0x3c], 0x20
mov dword [ebp - 0x40], eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add eax, 8
push eax
lea eax, [ebp - 0x40]
push eax
push 0x19
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x45f5d0
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 1
jle 0x45f5b2
push dword [eax - 0xc]
lea ecx, [ebp + 8]
call fcn.00418f15
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x60]
push ecx
lea ecx, [ebp - 0xe8]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov ebx, eax
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x30]
call esi
push dword [ebp - 0x38]
call esi
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00419521
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.00609802
mov esp, ebp
pop ebp
ret
Function at 0x45f600
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x14
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
jne 0x45f618
xor al, al
jmp 0x45f6f3
push ebx
push esi
add eax, 0xfffffff0
push edi
push eax
call fcn.00418dea
pop ecx
lea ecx, [ebp - 4]
lea esi, [eax + 0x10]
mov eax, dword [esi - 0xc]
dec eax
mov dword [ebp - 4], esi
push eax
call fcn.004791f8
push 0x5c
pop ecx
cmp ax, cx
je 0x45f64c
push ecx
lea ecx, [ebp - 4]
call fcn.00454d31
mov esi, dword [ebp - 4]
and dword [ebp - 0x14], 0
xor ebx, ebx
and dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
call fcn.00418f81
push eax
lea ecx, [ebp - 8]
call fcn.0041775d
xor edi, edi
mov byte [ebp + 0xb], bl
cmp dword [esi - 0xc], ebx
jle 0x45f6ae
push 0x5c
pop ebx
push edi
lea ecx, [ebp - 4]
call fcn.004791f8
cmp ax, bx
je 0x45f690
push edi
lea ecx, [ebp - 4]
call fcn.004791f8
movzx eax, ax
push eax
jmp 0x45f69d
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x14]
call fcn.0044e05e
push ebx
lea ecx, [ebp - 8]
call fcn.00454d31
inc edi
cmp edi, dword [esi - 0xc]
jl 0x45f673
mov ebx, dword [ebp - 0x10]
xor edi, edi
test ebx, ebx
jle 0x45f6d2
push edi
lea ecx, [ebp - 0x14]
call fcn.0044c702
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne byte [ebp + 0xb]
inc edi
cmp edi, ebx
jl 0x45f6b4
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00419521
lea ecx, [ebp - 0x14]
call fcn.004e8a9c
lea ecx, [esi - 0x10]
call fcn.00419521
mov al, byte [ebp + 0xb]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45f6f7
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00418dea
pop ecx
lea ecx, [ebp - 4]
lea esi, [eax + 0x10]
mov eax, dword [esi - 0xc]
dec eax
mov dword [ebp - 4], esi
push eax
call fcn.004791f8
push 0x5c
pop ecx
cmp ax, cx
je 0x45f736
push ecx
lea ecx, [ebp - 4]
call fcn.00454d31
mov esi, dword [ebp - 4]
and dword [ebp - 0x14], 0
xor ebx, ebx
and dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
call fcn.00418f81
push eax
lea ecx, [ebp - 8]
call fcn.0041775d
xor edi, edi
mov byte [ebp + 0xb], bl
cmp dword [esi - 0xc], ebx
jle 0x45f798
push 0x5c
pop ebx
push edi
lea ecx, [ebp - 4]
call fcn.004791f8
cmp ax, bx
je 0x45f77a
push edi
lea ecx, [ebp - 4]
call fcn.004791f8
movzx eax, ax
push eax
jmp 0x45f787
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x14]
call fcn.0044e05e
push ebx
lea ecx, [ebp - 8]
call fcn.00454d31
inc edi
cmp edi, dword [esi - 0xc]
jl 0x45f75d
mov ebx, dword [ebp - 0x10]
xor edi, edi
test ebx, ebx
jle 0x45f7bc
push edi
lea ecx, [ebp - 0x14]
call fcn.0044c702
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne byte [ebp + 0xb]
inc edi
cmp edi, ebx
jl 0x45f79e
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00419521
lea ecx, [ebp - 0x14]
call fcn.004e8a9c
lea ecx, [esi - 0x10]
call fcn.00419521
mov al, byte [ebp + 0xb]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45fa4d
Capabilities:
Create process on windows
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
mov eax, dword [0x7286bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, 0x22c
lea eax, [ebp - 0x230]
push ebx
xor edi, edi
push edi
push eax
call fcn.0060b7a0
add esp, 0xc
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x230], ebx
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x45fabe
lea eax, [ebp - 0x20c]
push str.explorer.exe
push eax
call fcn.0063cf0b
pop ecx
pop ecx
test eax, eax
je 0x45fac4
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x45fa9a
jmp 0x45fad9
push dword [ebp - 0x228]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
test edi, edi
je 0x45fb60
push edi
call fcn.004a8941
pop ecx
test eax, eax
je 0x45fb60
push 0x44
xor esi, esi
lea eax, [ebp - 0x284]
push esi
push eax
call fcn.0060b7a0
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
add esp, 0xc
movups xmmword [ebp - 0x240], xmm0
cmp dword [eax - 4], 1
jle 0x45fb26
push dword [eax - 0xc]
lea ecx, [ebp + 8]
call fcn.00418f15
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x240]
push ecx
lea ecx, [ebp - 0x284]
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x45fb7d
push dword [ebp - 0x240]
call ebx
push dword [ebp - 0x23c]
call ebx
jmp 0x45fb7d
mov eax, dword [ebp + 8]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
call fcn.00418dea
add eax, 0x10
pop ecx
mov dword [esi], eax
call fcn.0045f467
pop ecx
mov esi, eax
test edi, edi
je 0x45fb84
push edi
call ebx
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00609802
mov esp, ebp
pop ebp
ret
Function at 0x460161
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x7286bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xb0], ecx
push 6
pop edx
mov byte [ebp - 0x3c], 0
lea edi, [ebp - 0x3b]
mov ecx, edx
mov byte [ebp - 0x74], 0
rep stosd dword es:[edi], eax
mov ecx, edx
mov byte [ebp - 0x20], 0
mov byte [ebp - 0x58], 0
mov esi, dword [ebp + 8]
stosw word es:[edi], ax
mov ebx, dword [ebp + 0xc]
push 0x1c
push esi
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x73]
rep stosd dword es:[edi], eax
mov ecx, edx
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x1f]
rep stosd dword es:[edi], eax
mov ecx, edx
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x57]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x3c]
push eax
call fcn.0060aca0
push 0x1c
lea eax, [esi + 0x1c]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.0060aca0
add esp, 0x18
imul edi, ebx, 0x300
xor esi, esi
push 0x1c
add edi, dword [ebp - 0xb0]
pop ebx
movsx ecx, byte [esi + 0x6850d4]
mov eax, ebx
sub eax, ecx
push eax
lea eax, [ebp - 0x3c]
add eax, ecx
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0060aca0
movsx ecx, byte [esi + 0x6850d4]
lea eax, [ebp - 0x3c]
push ecx
push eax
lea eax, [ebp - 4]
sub eax, ecx
push eax
call fcn.0060aca0
movsx ecx, byte [esi + 0x6850d4]
mov eax, ebx
sub eax, ecx
push eax
lea eax, [ebp - 0x74]
add eax, ecx
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0060aca0
movsx ecx, byte [esi + 0x6850d4]
lea eax, [ebp - 0x74]
push ecx
push eax
lea eax, [ebp - 0x3c]
sub eax, ecx
push eax
call fcn.0060aca0
push 0x38
lea eax, [ebp - 0xac]
push 0
push eax
call fcn.0060b7a0
push ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xac]
push eax
call fcn.0060aca0
add esp, 0x48
lea eax, [ebp - 0x58]
push ebx
push eax
lea eax, [ebp - 0x90]
push eax
call fcn.0060aca0
add esp, 0xc
xor ecx, ecx
movsx eax, byte [ecx + 0x6850a4]
mov al, byte [ebp + eax - 0xad]
mov byte [edi + ecx], al
inc ecx
cmp ecx, 0x30
jl 0x460293
push ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0060aca0
push ebx
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.0060aca0
add esp, 0x18
add edi, 0x30
inc esi
cmp esi, 0x10
jl 0x4601f5
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00609802
mov esp, ebp
pop ebp
ret 8