joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444fb7
Capabilities:
Get common file path
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
add ecx, 0x3ad4
push esi
xor esi, esi
cmp word [ecx], si
je 0x445026
mov eax, esi
mov edx, esi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
test ecx, ecx
je 0x444fef
lea eax, [ebp - 8]
push eax
push esi
push esi
push ecx
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceExW]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
and eax, 0xfff00000
cmp edx, esi
ja 0x445026
jb 0x445001
cmp eax, 0x3e800000
jae 0x445026
lea eax, [ebp - 0x210]
push eax
push 0x103
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
test eax, eax
je 0x445026
push esi
xor edx, edx
lea ecx, [ebp - 0x210]
call fcn.00449baf
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4460f6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push 0x40
xor ebx, ebx
lea eax, [ebp - 0x54]
push ebx
push eax
mov esi, ecx
call fcn.004183a0
or dword [ebp - 0xc], 0xffffffff
add esp, 0xc
mov dword [ebp - 0x10], 0x463ee4
mov dword [ebp - 8], ebx
cmp dword [ebp + 8], ebx
je 0x4461a2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x446136
mov bl, 1
jmp 0x4461a2
push ecx
push 3
push 3
push SysReAllocString
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.004011ce
test al, al
je 0x4461a2
push 0x40
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040128f
cmp eax, 0x40
jne 0x4461a2
mov ax, word [ebp - 0x30]
lea ecx, [ebp - 0x10]
mov word [ebp - 8], ax
mov ax, word [ebp - 0x2e]
push ebx
push ebx
mov word [ebp - 6], ax
push dword [ebp - 8]
call fcn.0040123d
and eax, edx
cmp eax, 0xffffffff
je 0x4461a2
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.0041404f
test al, al
je 0x44619b
cmp dword [esi + 0x14], 1
jne 0x446186
cmp dword [esi + 0x14], 1
sete bl
cmp dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x10], 0x463ee4
je 0x4461b8
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44685a
Capabilities:
Get proxy
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 4]
mov dword [esi + 8], edi
test eax, eax
je 0x446875
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 4]
push eax
push 0x20019
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x44689a
xor al, al
jmp 0x446932
mov eax, dword [esi + 0xc]
mov dword [ebp - 8], edi
lea eax, [eax*2 - 2]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push dword [esi + 4]
lea eax, [ebp - 8]
push eax
push edi
push str.ProxyServer
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
test eax, eax
je 0x4468d3
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x446893
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, esi
call fcn.00401be0
cmp dword [ebp - 8], 1
je 0x4468f7
mov eax, dword [esi + 4]
mov dword [esi + 8], edi
test eax, eax
je 0x446893
xor ecx, ecx
mov word [eax], cx
jmp 0x446893
push 0x463a38
mov ecx, esi
call fcn.00411d77
test eax, eax
js 0x446911
inc eax
push eax
push ecx
mov ecx, esi
call fcn.0041430d
push 0x463a3c
mov ecx, esi
call fcn.00411d77
test eax, eax
js 0x446929
push eax
mov ecx, esi
call fcn.0040778e
mov ecx, esi
call fcn.00401782
xor al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x446b5c
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
push edi
mov edi, ecx
jb 0x446bb1
cmp dword [edi + 0x10], 0
je 0x446bb1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x10]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x446bad
push esi
mov esi, dword [edi + 0x18]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push dword [edi + 0x224]
lea eax, [edi + 0x360]
push esi
push str._s:_u_read_failed___u_
push eax
call fcn.0040c813
add esp, 0x14
pop esi
jmp 0x446bb7
mov al, 1
jmp 0x446bb9
mov eax, dword [ebp + 0x10]
and dword [eax], 0
xor al, al
pop edi
pop ebp
ret 0xc

Function at 0x446c02
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
and dword [edi + 0x368], 0
lea ebx, [edi + 0x360]
mov eax, dword [edi + 0x364]
test eax, eax
je 0x446c27
xor ecx, ecx
mov word [eax], cx
cmp dword [edi + 0x10], 0
je 0x446c80
cmp dword [ebp + 8], 0
je 0x446c80
mov esi, dword [ebp + 0xc]
push 0
mov eax, dword [esi + 0xc]
lea eax, [eax*2 - 2]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [esi + 4]
push dword [ebp + 8]
push 0xffff
push dword [edi + 0x10]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x446c8b
mov esi, dword [edi + 0x18]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push dword [edi + 0x224]
push esi
push str._s:_u_get_header_failed___u_
push ebx
call fcn.0040c813
add esp, 0x14
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, esi
call fcn.00401be0
mov al, 1
jmp 0x446c82
Function at 0x4472d9
Capabilities:
Initialize winhttp library

Disassembly:
sub esp, 0x21c
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov eax, dword [esi + 0x364]
mov dword [esi + 0x368], ebx
test eax, eax
je 0x4472fc
xor ecx, ecx
mov word [eax], cx
mov ebp, dword [esp + 0x230]
test ebp, ebp
je 0x4474e0
mov edi, dword [esp + 0x238]
test edi, edi
je 0x4474e0
cmp byte [esi + 0x228], bl
jne 0x4474e0
mov ecx, esi
call fcn.00447276
cmp dword [esi + 8], ebx
je 0x44733e
push dword [esi + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov dword [esi + 8], ebx
lea ecx, [esp + 0x18]
call fcn.00411345
mov ecx, 0x47cfe0
call fcn.00401782
test al, al
je 0x447368
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.MetaTrader_5
call fcn.004480a3
add esp, 0x1c
push 0x4ab42c
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
push 0x47cfe0
lea ecx, [esp + 0x1c]
call fcn.0040d181
push 0x4ab42c
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov byte [esp + 0x17], bl
cmp word [edi], bx
je 0x4473b4
push edi
lea ecx, [esi + 0x22c]
mov byte [esi + 0x22a], 1
mov byte [esp + 0x1b], 1
call fcn.0040c54b
push ebx
push ebx
push edi
push 3
jmp 0x4473b9
push ebx
push ebx
push ebx
push 1
push dword [esp + 0x2c]
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [esi + 8], eax
test eax, eax
jne 0x4473ea
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea eax, [esi + 0x360]
push str.HTTP_session_creation_failed___u_
push eax
call fcn.0040c813
add esp, 0xc
jmp 0x4474dc
push ebp
lea eax, [esp + 0x12c]
mov dword [esi + 0x224], 0x1bb
push 0x80
push eax
call fcn.0041caeb
lea eax, [esp + 0x134]
push 0x45dd54
push eax
call fcn.0041779d
add esp, 0x14
test eax, eax
je 0x447435
xor ecx, ecx
mov word [eax], cx
add eax, 2
push eax
call fcn.00425442
pop ecx
mov dword [esi + 0x224], eax
lea eax, [esp + 0x128]
push eax
lea ecx, [esi + 0x14]
call fcn.0040c54b
movzx eax, word [esi + 0x224]
push ebx
push eax
push dword [esi + 0x18]
push dword [esi + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov dword [esi + 0xc], eax
cmp byte [esp + 0x23c], bl
je 0x44747c
test eax, eax
je 0x44747c
mov ecx, esi
call fcn.00446938
test al, al
jne 0x44747c
mov ecx, esi
call fcn.00447276
cmp dword [esi + 0xc], ebx
jne 0x4474c7
lea edx, [esi + 0x360]
mov ecx, edx
call fcn.00401782
test al, al
je 0x4474dc
mov eax, dword [esi + 0x224]
cmp byte [esp + 0x17], bl
je 0x4474b3
push edi
push eax
push dword [esi + 0x18]
push str._s:_u_via_proxy__s_failed
push edx
call fcn.0040c813
add esp, 0x14
jmp 0x4474dc
push eax
push dword [esi + 0x18]
push str._s:_u_failed
push edx
call fcn.0040c813
add esp, 0x10
jmp 0x4474dc
push ebx
call fcn.004233e0
pop ecx
mov dword [esi + 0x350], eax
mov bl, 1
mov dword [esi + 0x354], edx
mov al, bl
jmp 0x4474e2
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x21c
ret 0x10
Function at 0x447938
Capabilities:
Identify system language via api

Disassembly:
sub esp, 0x80
push esi
mov esi, ecx
push edi
and dword [esi + 8], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x447952
xor ecx, ecx
mov word [eax], cx
push ebx
push ebp
mov ebx, 0x4ab42c
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov edi, 0x47d630
mov ecx, edi
call fcn.00401782
test al, al
jne 0x447984
push str.utm_link
mov ecx, esi
call fcn.0040c7b8
push edi
mov ecx, esi
call fcn.0040c9a2
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
call dword [sym.imp.KERNEL32.DLL_GetUserDefaultUILanguage]
movzx eax, ax
push eax
push str.utm_codepage_u
lea eax, [esp + 0x18]
push 0x3f
push eax
call fcn.0041144b
add esp, 0x10
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.0040c7b8
mov ebx, 0x100
xor eax, eax
push ebx
mov word [esp + 0x14], ax
mov ebp, str.SOFTWAREMetaQuotes_Software
lea eax, [esp + 0x14]
mov edx, ebp
lea edi, [ebx - 0x80]
mov ecx, SysReAllocString
push edi
push eax
push 0x462db8
call fcn.00408e7e
add esp, 0x10
test al, al
je 0x447a08
cmp word [esp + 0x10], 0
je 0x447a08
push str.utm_gid
mov ecx, esi
call fcn.0040c7b8
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.0040c7b8
xor eax, eax
mov edx, ebp
push ebx
mov word [esp + 0x14], ax
mov ecx, SysReAllocString
push edi
lea eax, [esp + 0x18]
push eax
push 0x45cf30
call fcn.00408e7e
add esp, 0x10
pop ebp
pop ebx
test al, al
je 0x447a50
cmp word [esp + 8], 0
je 0x447a50
push str.utm_uniq
mov ecx, esi
call fcn.0040c7b8
lea eax, [esp + 8]
mov ecx, esi
push eax
call fcn.0040c7b8
lea eax, [esp + 8]
mov byte [eax], 0
inc eax
sub edi, 1
jne 0x447a54
pop edi
pop esi
add esp, 0x80
ret
Function at 0x448edd
Capabilities:
Get graphical window text

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowTextW]
push edi
mov edi, ecx
push 0x7f
lea ebp, [edi + 0x20]
push ebp
push dword [edi + 0x324]
call esi
push 0x3f
lea ebx, [edi + 0x220]
push ebx
push dword [edi + 0x56c]
call esi
push 0x3f
lea eax, [edi + 0x2a0]
push eax
push dword [edi + 0x590]
call esi
xor esi, esi
lea eax, [edi + 0x120]
cmp word [ebx], si
je 0x448f43
lea ecx, [edi + 0x2a0]
push ecx
push ebx
push str._s:_s
push 0x80
push eax
call fcn.0041144b
add esp, 0x14
jmp 0x448f48
xor ecx, ecx
mov word [eax], cx
cmp word [ebp], si
jne 0x448f66
push dword [edi + 0x324]
call dword [sym.imp.USER32.dll_SetFocus]
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
xor al, al
jmp 0x448f68
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4496ee
Capabilities:
Check if file exists
Create directory
Delete file
Get common file path
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x41c
lea eax, [esp + 0x210]
push ebx
push ebp
push esi
push edi
push 0x208
xor ebx, ebx
mov esi, ecx
push ebx
push eax
call fcn.004183a0
add esp, 0xc
cmp dword [esi + 0x228], ebx
je 0x4498e8
cmp dword [esi + 0x22c], 0x400
jb 0x4498e8
lea eax, [esp + 0x220]
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4498e8
lea eax, [esp + 0x220]
push eax
push 0x45bcc0
lea eax, [esp + 0x20]
push 0x104
push eax
call fcn.0041144b
mov ebp, dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
lea eax, [esp + 0x28]
add esp, 0x10
push eax
call ebp
mov ecx, eax
and al, 0x13
cmp al, 0x10
je 0x449793
push ebx
xor edx, edx
lea ecx, [esp + 0x1c]
call fcn.00449baf
pop ecx
lea eax, [esp + 0x18]
push eax
call ebp
mov ecx, eax
mov edi, dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
cmp ecx, 0xffffffff
jne 0x4497a6
push ebx
lea eax, [esp + 0x1c]
push eax
call edi
lea eax, [esp + 0x220]
push eax
push str._sMetaQuotesWebInstall
lea eax, [esp + 0x20]
push 0x104
push eax
call fcn.0041144b
add esp, 0x10
lea eax, [esp + 0x18]
push eax
call ebp
mov ecx, eax
and al, 0x13
cmp al, 0x10
je 0x4497ea
push ebx
xor edx, edx
lea ecx, [esp + 0x1c]
call fcn.00449baf
pop ecx
lea eax, [esp + 0x18]
push eax
call ebp
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x4497f7
push ebx
lea eax, [esp + 0x1c]
push eax
call edi
or dword [esp + 0x14], 0xffffffff
lea eax, [esp + 0x18]
push esi
push eax
push str._s_S
lea eax, [esp + 0x22c]
mov dword [esp + 0x1c], 0x463ee4
push 0x104
push eax
call fcn.0041144b
add esp, 0x10
lea eax, [esp + 0x224]
lea ecx, [esp + 0x14]
push 2
push 3
push 0x40000000
push eax
call fcn.004011ce
test al, al
jne 0x44989e
lea edi, [esi + 0x20]
cmp word [edi], bx
je 0x44989e
push edi
call ebp
cmp eax, 0xffffffff
jne 0x44985c
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
jmp 0x449868
push 0x80
push edi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push esi
push edi
push str._s_S
lea eax, [esp + 0x22c]
push 0x104
push eax
call fcn.0041144b
add esp, 0x10
lea eax, [esp + 0x224]
lea ecx, [esp + 0x14]
push 2
push 3
push 0x40000000
push eax
call fcn.004011ce
cmp dword [esp + 0x14], 0xffffffff
je 0x4498e4
push dword [esi + 0x22c]
lea ecx, [esp + 0x14]
push dword [esi + 0x228]
call fcn.0040a9bb
push dword [esp + 0x14]
cmp eax, dword [esi + 0x22c]
je 0x4498dc
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [esp + 0x220]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
jmp 0x4498e4
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov bl, 1
mov al, bl
jmp 0x4498ea
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
Function at 0x4498f5
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
lea eax, [ebp - 0x440]
push ebx
push esi
push edi
push 0x208
xor ebx, ebx
mov esi, ecx
push ebx
push eax
call fcn.004183a0
add esp, 0xc
lea edi, [ebp - 0x30]
xor eax, eax
push 9
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x228]
test eax, eax
je 0x44993b
push eax
call fcn.004166cf
pop ecx
mov dword [esi + 0x228], ebx
lea eax, [ebp - 0x440]
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x449958
xor al, al
jmp 0x449a5b
push esi
lea eax, [ebp - 0x440]
push eax
push str._sMetaQuotesWebInstall_S
lea eax, [ebp - 0x238]
push 0x104
push eax
call fcn.0041144b
add esp, 0x14
lea eax, [ebp - 0x30]
push eax
push ebx
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesExW]
test eax, eax
jne 0x4499d8
lea edi, [esi + 0x20]
cmp word [edi], bx
je 0x449951
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x449951
push esi
push edi
push str._s_S
lea eax, [ebp - 0x238]
push 0x104
push eax
call fcn.0041144b
add esp, 0x14
lea eax, [ebp - 0x30]
push eax
push ebx
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesExW]
test eax, eax
je 0x449951
mov eax, dword [esi + 0x22c]
sub eax, 0x2b1
cmp dword [ebp - 0x10], eax
je 0x4499fa
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
jmp 0x449951
or dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x238]
mov dword [ebp - 0xc], 0x463ee4
push eax
lea ecx, [ebp - 0xc]
mov dword [ebp - 4], ebx
call fcn.0040a911
mov ecx, eax
mov eax, dword [ebp - 4]
mov dword [esi + 0x228], ecx
cmp eax, dword [ebp - 0x10]
jne 0x449a3d
test ecx, ecx
je 0x449a3d
add dword [esi + 0x22c], 0xfffffd4f
mov bl, 1
jmp 0x449a4a
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
cmp dword [ebp - 8], 0xffffffff
je 0x449a59
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x449abe
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x304
push ebx
push esi
mov esi, ecx
push edi
and dword [esi + 0x228], 0
cmp dword [ebp + 8], 0
mov dword [esi + 0x22c], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x230], eax
je 0x449af8
push dword [ebp + 8]
push 0x20
pop edx
call fcn.004160b5
jmp 0x449afb
mov byte [esi], 0
xor eax, eax
lea edi, [esi + 0x20]
mov word [edi], ax
mov ebx, 0x103
lea eax, [ebp - 0x304]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
test eax, eax
je 0x449ba4
lea eax, [ebp - 0x304]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x449ba4
lea ecx, [ebp - 0x7c]
call fcn.0043a71b
lea ecx, [ebp - 0x10]
call fcn.00408955
push 0x10
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x7c]
call fcn.0043a631
push 7
push str.install
lea ecx, [ebp - 0x7c]
call fcn.0043a631
lea ecx, [ebp - 0x7c]
call fcn.0043a5be
push 0x3f
lea eax, [ebp - 0xfc]
push eax
lea ecx, [ebp - 0x7c]
call fcn.0043a55c
xor eax, eax
mov word [ebp - 0xdc], ax
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0x304]
push eax
push str._s_s
push ebx
push edi
call fcn.0041144b
add esp, 0x14
lea ecx, [ebp - 0x7c]
call fcn.0043a6ef
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x449baf
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x468
xor eax, eax
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, edx
push edi
cmp word [esi], ax
je 0x449d64
cmp ebp, 0xf
jg 0x449d64
push 0x250
push eax
lea eax, [esp + 0x230]
push eax
call fcn.004183a0
add esp, 0xc
lea ecx, [esp + 0x10]
call fcn.0040b6e3
push esi
mov eax, ecx
push str._s.
push eax
call fcn.0040c813
add esp, 0xc
lea eax, [esp + 0x228]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov edi, dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x449d40
lea eax, [esp + 0x254]
push eax
push esi
lea eax, [esp + 0x18]
push 0x45c788
push eax
call fcn.0040c813
add esp, 0x10
test byte [esp + 0x228], 0x10
je 0x449d03
mov ecx, 0x45c794
lea eax, [esp + 0x254]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x449c7f
test dx, dx
je 0x449c7b
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x449c7f
add eax, 4
add ecx, 4
test dx, dx
jne 0x449c59
xor eax, eax
jmp 0x449c84
sbb eax, eax
or eax, 1
test eax, eax
je 0x449d22
mov ecx, 0x4607f0
lea eax, [esp + 0x254]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x449cbe
test dx, dx
je 0x449cba
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x449cbe
add eax, 4
add ecx, 4
test dx, dx
jne 0x449c98
xor eax, eax
jmp 0x449cc3
sbb eax, eax
or eax, 1
test eax, eax
je 0x449d22
test byte [esp + 0x228], 1
je 0x449cdc
push 0x80
push dword [esp + 0x18]
call edi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x449cfa
push dword [esp + 0x47c]
lea edx, [ebp + 1]
mov ecx, eax
call fcn.00449baf
mov eax, dword [esp + 0x18]
pop ecx
push eax
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
jmp 0x449d22
test byte [esp + 0x228], 1
je 0x449d18
push 0x80
push dword [esp + 0x18]
call edi
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
lea eax, [esp + 0x228]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x449c24
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
cmp byte [esp + 0x47c], 0
je 0x449d64
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
test al, 1
je 0x449d5d
push 0x80
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x468
ret

Function at 0x44aac5
Capabilities:
Terminate thread

Disassembly:
push ebx
mov bl, byte [esp + 8]
push esi
mov esi, ecx
lea ecx, [esi + 8]
call fcn.00447276
push 0x7d0
mov ecx, esi
call fcn.0040d798
test al, al
jne 0x44ab03
cmp dword [esi + 4], 0
je 0x44ab03
push 0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
and dword [esi + 4], 0
test bl, bl
je 0x44ab11
mov esi, dword [esi + 0x1264]
test esi, esi
jne 0x44aacd
pop esi
pop ebx
ret 4
Function at 0x44aedc
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [esp + 0xc]
sub esp, 0xf4
mov eax, 0x5a4d
push ebx
push ebp
push esi
push edi
cmp word [edx], ax
jne 0x44afd5
mov eax, dword [esp + 0x114]
mov ebx, dword [edx + 0x3c]
mov ebp, dword [eax]
cmp ebx, ebp
jge 0x44afd5
cmp dword [ebx + edx], 0x4550
jne 0x44afd5
movzx eax, word [ebx + edx + 4]
mov edi, 0x14c
cmp ax, di
je 0x44af36
mov ecx, 0x8664
cmp ax, cx
jne 0x44afd5
lea esi, [edx + 0x18]
add esi, ebx
cmp ax, di
jne 0x44af6a
push 0x38
pop ecx
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x108]
mov eax, dword [esp + 0x90]
mov dword [ecx], eax
mov eax, dword [esp + 0x94]
mov dword [ecx + 4], eax
mov eax, 0x98
jmp 0x44af92
push 0x3c
pop ecx
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x108]
mov eax, dword [esp + 0xa0]
mov dword [ecx], eax
mov eax, dword [esp + 0xa4]
mov dword [ecx + 4], eax
mov eax, 0xa8
mov edi, dword [esp + 0x10c]
lea esi, [ebx + eax]
test edi, edi
je 0x44afd1
test esi, esi
je 0x44afd1
cmp dword [ecx], 0
je 0x44afd1
mov eax, dword [ecx + 4]
test eax, eax
je 0x44afd1
cmp esi, ebp
jae 0x44afd5
add eax, edi
mov dword [ecx + 4], eax
lea eax, [edi + ebp]
mov edi, dword [esp + 0x114]
mov dword [edi], eax
mov eax, dword [ecx]
mov dword [esi + edx], eax
mov eax, dword [ecx + 4]
mov dword [esi + edx + 4], eax
mov al, 1
jmp 0x44afd7
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret 0x10
Function at 0x44afe4
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x22c
push ebx
push ebp
push esi
push edi
xor eax, eax
lea edi, [esp + 0x14]
stosd dword es:[edi], eax
xor ebx, ebx
push 0x40
mov esi, ecx
mov dword [esp + 0x14], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
push eax
call fcn.0040128f
cmp eax, 0x40
jne 0x44b148
mov eax, 0x5a4d
cmp word [esp + 0x28], ax
jne 0x44b148
mov eax, dword [esp + 0x64]
mov ecx, esi
push ebx
cdq
push edx
push eax
call fcn.0040123d
mov ecx, eax
mov edi, edx
mov eax, dword [esp + 0x64]
cdq
cmp ecx, eax
jne 0x44b148
cmp edi, edx
jne 0x44b148
push 4
lea eax, [esp + 0x14]
mov ecx, esi
push eax
call fcn.0040128f
cmp eax, 4
jne 0x44b148
cmp dword [esp + 0x10], 0x4550
jne 0x44b148
push 0x14
lea eax, [esp + 0x18]
mov ecx, esi
push eax
call fcn.0040128f
cmp eax, 0x14
jne 0x44b148
mov eax, 0x14c
cmp word [esp + 0x14], ax
je 0x44b0a6
mov eax, 0x8664
cmp word [esp + 0x14], ax
jne 0x44b148
mov edi, 0xe0
lea eax, [esp + 0x68]
push edi
push ebx
push eax
call fcn.004183a0
add esp, 0xc
lea ebp, [edi + 0x10]
lea eax, [esp + 0x148]
push ebp
push ebx
push eax
call fcn.004183a0
add esp, 0xc
lea eax, [edi + 0x6c]
mov ecx, esi
push 1
push ebx
push ebx
cmp word [esp + 0x20], ax
jne 0x44b111
call fcn.0040123d
push edi
lea eax, [esp + 0x6c]
mov ecx, esi
push eax
call fcn.0040128f
cmp eax, edi
jne 0x44b148
mov ecx, dword [esp + 0x240]
mov eax, dword [esp + 0xe8]
mov dword [ecx], eax
mov eax, dword [esp + 0xec]
mov dword [ecx + 4], eax
jmp 0x44b144
call fcn.0040123d
push ebp
lea eax, [esp + 0x14c]
mov ecx, esi
push eax
call fcn.0040128f
cmp eax, ebp
jne 0x44b148
mov edx, dword [esp + 0x240]
mov ecx, dword [esp + 0x1d8]
mov dword [edx], ecx
mov ecx, dword [esp + 0x1dc]
mov dword [edx + 4], ecx
mov al, 1
jmp 0x44b14a
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x22c
ret 8