joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41fb5c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e36b2
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push ebx
push esi
push edi
mov eax, dword [0x52472c]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
add eax, 0x190
push eax
call fcn.00403204
pop ecx
test eax, eax
jne 0x41fd8c
mov esi, dword [ebp + 0xc]
lea eax, [esp + 0x24]
push eax
add esi, 4
call fcn.00404885
and dword [esp + 0x80], 0
push 0x4ed47c
lea ecx, [esp + 0x40]
call fcn.00404357
mov byte [esp + 0x80], 1
push esi
lea ecx, [esp + 0x40]
lea ebx, [esp + 0x28]
call fcn.0044c050
pop ecx
mov byte [esp + 0x80], 0
push 0
push 1
lea ecx, [esp + 0x44]
call fcn.004035da
mov esi, dword [esp + 0x30]
cmp esi, dword [esp + 0x34]
jbe 0x41fc00
call fcn.004b3673
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], esi
mov esi, dword [esp + 0x34]
cmp dword [esp + 0x30], esi
jbe 0x41fc1b
call fcn.004b3673
mov eax, dword [esp + 0x24]
mov dword [esp + 0x20], esi
lea edi, [esp + 0x1c]
lea esi, [esp + 0x14]
mov dword [esp + 0x1c], eax
call fcn.00423840
test al, al
je 0x41fd7a
call fcn.0042385d
mov esi, eax
lea eax, [esp + 0x3c]
push eax
call fcn.00404885
mov byte [esp + 0x80], 2
push 0x4f03f4
lea ecx, [esp + 0x5c]
call fcn.00404357
mov byte [esp + 0x80], 3
push esi
lea ecx, [esp + 0x5c]
lea ebx, [esp + 0x40]
call fcn.0044c050
pop ecx
mov byte [esp + 0x80], 2
push 0
push 1
lea ecx, [esp + 0x60]
call fcn.004035da
mov edi, dword [ebp + 8]
lea ecx, [edi + 0x24]
mov eax, dword [ecx]
call dword [eax + 0x34]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 4]
push 0
lea esi, [esp + 0x40]
mov ebx, eax
call fcn.00408a7c
mov ecx, ebx
call fcn.0040ec20
test al, al
je 0x41fd5a
xor ebx, ebx
push 0x4f03f8
inc ebx
push ebx
call fcn.00408a7c
mov esi, eax
call fcn.00409208
pop ecx
test al, al
je 0x41fce4
mov ebx, dword [edi + 0x1a4]
call fcn.00402fc0
jmp 0x41fd5a
push str.Pause
push ebx
lea esi, [esp + 0x44]
call fcn.00408a7c
mov esi, eax
call fcn.00409208
pop ecx
test al, al
je 0x41fd0c
mov ebx, dword [edi + 0x1a4]
call fcn.00402f72
jmp 0x41fd5a
push str.Rewind
push ebx
lea esi, [esp + 0x44]
call fcn.00408a7c
mov esi, eax
call fcn.00409208
pop ecx
test al, al
je 0x41fd34
mov ebx, dword [edi + 0x1a4]
call fcn.0040303b
jmp 0x41fd5a
push str.Stop
push ebx
lea esi, [esp + 0x44]
call fcn.00408a7c
mov esi, eax
call fcn.00409208
pop ecx
test al, al
je 0x41fd5a
mov ecx, dword [edi + 0x1a4]
call fcn.004030a8
mov byte [esp + 0x80], 0
lea eax, [esp + 0x3c]
push eax
call fcn.004048bd
lea esi, [esp + 0x14]
call fcn.0041d597
jmp 0x41fc0c
or dword [esp + 0x80], 0xffffffff
lea eax, [esp + 0x24]
push eax
call fcn.004048bd
mov al, 1
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x429654
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [esi + 0x54]
mov ecx, eax
and ecx, 0xc
push edi
mov byte [ebp - 1], 1
cmp cl, 0xc
jne 0x42969e
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
push eax
mov dword [ebp - 0x10], eax
call edi
push dword [esi + 4]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0xfffffffe
call edi
push dword [esi + 4]
mov edi, eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [ebp - 0x10]
push ecx
push edi
push 0x4e
jmp 0x4296c5
shr eax, 2
test al, 1
je 0x4296ce
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push dword [esi + 4]
mov edi, eax
call dword [sym.imp.USER32.dll_GetParent]
push dword [esi + 4]
movzx ecx, di
push ecx
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x429701
push ebx
push 1
xor ebx, ebx
push ebx
push ebx
push dword [esi + 0x28]
push 0x4f1424
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
seta byte [ebp - 1]
cmp byte [ebp - 1], bl
je 0x429700
or byte [esi + 0x58], 2
push 1
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop ebx
mov al, byte [ebp - 1]
pop edi
leave
ret
Function at 0x42a0b2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42a116
cmp dword [ebp + 0xc], 1
je 0x42a0ee
cmp dword [ebp + 0xc], 2
je 0x42a0ee
push 0xd
pop eax
jmp 0x42a116
mov eax, dword [ebp - 4]
test edi, edi
je 0x42a110
test eax, eax
je 0x42a10b
test al, 1
jne 0x42a0e9
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x42a110
jmp 0x42a0e9
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8
Function at 0x43a69c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d3461
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
mov eax, dword [0x52472c]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x18], 8
jb 0x43a6d5
mov eax, dword [eax + 4]
jmp 0x43a6d8
add eax, 4
push eax
lea esi, [esp + 0x30]
call fcn.0043fefa
and dword [esp + 0x48], 0
push 3
pop eax
mov word [esp + 0x1c], ax
mov dword [esp + 0x24], 0xe
mov byte [esp + 0x48], 1
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [esp + 0x48], 2
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1a4]
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
push edx
push edx
lea edx, [esp + 0x28]
push edx
mov edx, esi
push edx
push eax
call dword [ecx + 0xd0]
test eax, eax
setge bl
mov byte [esp + 0x48], 1
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [esp + 0xc]
push eax
call esi
mov byte [esp + 0x48], 0
lea eax, [esp + 0x1c]
push eax
call esi
or dword [esp + 0x48], 0xffffffff
lea eax, [esp + 0x2c]
push eax
call esi
mov al, bl
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43a772
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e0830
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x52472c]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x52472c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 0xc0]
push eax
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, eax
lea ecx, [esp + 8]
call fcn.00440188
pop ecx
and dword [esp + 0x30], 0
lea eax, [esp + 4]
push eax
push esi
call fcn.0043a69c
or dword [esp + 0x30], 0xffffffff
push 0
push 1
lea ecx, [esp + 0xc]
call fcn.004035da
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004b196e
mov esp, ebp
pop ebp
ret 4
Function at 0x443ec8
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x10
mov eax, 0x4d0fdc
call fcn.004b80e2
mov edi, ecx
call fcn.00443e74
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
cmp esi, 0xffffffff
jne 0x443f12
or dword [ebp - 4], eax
push eax
jmp 0x443f97
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp + 8], eax
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0044445d
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
push dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
je 0x443f7f
cmp dword [ebp - 0x14], ebx
je 0x443f7f
push dword [ebp - 0x14]
mov eax, dword [edi]
push dword [ebp - 0x10]
mov ecx, edi
call dword [eax + 8]
mov byte [ebp + 0xb], al
mov byte [ebp - 4], bl
push dword [ebp - 0x10]
call fcn.004b39a5
pop ecx
mov dword [ebp - 0x10], ebx
or dword [ebp - 4], 0xffffffff
cmp esi, ebx
je 0x443f7a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1c], ebx
mov al, byte [ebp + 0xb]
jmp 0x443fa2
mov byte [ebp - 4], bl
push dword [ebp - 0x10]
call fcn.004b39a5
pop ecx
mov dword [ebp - 0x10], ebx
or dword [ebp - 4], 0xffffffff
cmp esi, ebx
je 0x443fa0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1c], ebx
xor al, al
call fcn.004b81ba
ret 4

Function at 0x444533
Capabilities:
Get disk information

Disassembly:
push 0x2c
mov eax, 0x4e2e1d
call fcn.004b814b
push edi
call fcn.00409d49
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 7
call fcn.00403660
mov dword [ebp - 4], ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push ebx
push ebx
call esi
push ebx
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x34], eax
call fcn.0044460f
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00408a54
push eax
push dword [ebp - 0x34]
call esi
cmp eax, ebx
jne 0x44459f
mov byte [ebp - 0x2d], bl
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.004035da
mov al, byte [ebp - 0x2d]
call fcn.004b81ce
ret
push eax
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00408a54
mov ebx, edi
mov ecx, eax
call fcn.0044c290
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
pop ecx
push 0x1c
cdq
pop ecx
idiv ecx
test eax, eax
seta byte [ebp - 0x2d]
xor ebx, ebx
jmp 0x444587
Function at 0x4463b1
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push 0x58
mov eax, 0x4dedb8
call fcn.004b80e2
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 1
mov eax, dword [ebx]
mov eax, dword [eax - 0xc]
xor esi, esi
cmp eax, esi
je 0x446564
lea eax, [ebp - 0x10]
push eax
call fcn.004029ba
mov byte [ebp - 4], 2
push 0x4f6738
lea eax, [ebp - 0x18]
push eax
call fcn.004054af
mov byte [ebp - 4], 3
lea edi, [ebp - 0x10]
lea ecx, [ebp - 0x18]
call fcn.0045fac0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00402964
push str..bat
mov eax, edi
push eax
call fcn.00446281
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], esi
mov byte [ebp - 4], 4
cmp edi, 0xffffffff
jne 0x446455
mov byte [ebp - 4], 2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x28], esi
jmp 0x446558
lea eax, [ebp - 0x18]
push eax
call fcn.004029ba
mov byte [ebp - 4], 5
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
call fcn.00447023
mov byte [ebp - 4], 6
cmp byte [ebx + 9], 0
mov eax, str._echo_off__r_nATTRIB__r___s___r_n:try__r_nrd___s___r_nif_exist___s__goto_try_r_nATTRIB__r___s___r_ndel___s___cls
jne 0x446482
mov eax, str._echo_off__r_nATTRIB__r___s___r_n:try__r_ndel___s___r_nif_exist___s__goto_try_r_nATTRIB__r___s___r_ndel___s___cls
push dword [ebp - 0x14]
push dword [ebp - 0x14]
push dword [ebx]
push dword [ebx]
push dword [ebx]
push eax
lea eax, [ebp - 0x18]
call fcn.004473d5
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax - 0xc]
add esp, 0x18
push esi
lea edx, [ebp - 0x20]
push edx
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov byte [ebp - 4], 5
lea eax, [ebp - 0x14]
push eax
call fcn.00447065
mov byte [ebp - 4], 4
lea eax, [ebp - 0x18]
push eax
call fcn.00447065
mov byte [ebp - 4], 2
cmp edi, esi
je 0x4464da
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x28], esi
lea eax, [ebp - 0x1c]
lea esi, [ebx + 4]
push eax
call fcn.0045f2f0
pop ecx
mov byte [ebp - 4], 7
cmp byte [ebx + 8], 0
jne 0x446509
xor eax, eax
push eax
push dword [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
push 0x4f1424
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x44654c
push 0x3c
pop edi
push edi
xor esi, esi
lea eax, [ebp - 0x64]
push esi
push eax
call fcn.004b3b00
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x4c], eax
add esp, 0xc
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x60], 0x500
mov dword [ebp - 0x58], str.runas
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x48], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.00402964
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.00402964
mov byte [ebp - 4], 0
lea ecx, [ebx + 4]
call fcn.00402964
or dword [ebp - 4], 0xffffffff
push ebx
call fcn.00447065
call fcn.004b81ba
ret 4
Function at 0x448484
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x448492
push 0xd
pop eax
jmp 0x4484c5
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x448499
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push 7
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x44afa8
Capabilities:
Get system information on windows

Disassembly:
push 0x54
mov eax, 0x4e1a3b
call fcn.004b814b
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x50]
movzx eax, ax
push str.kernel32.dll
mov dword [ebp - 0x34], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.IsWow64Process
push eax
mov dword [ebp - 0x30], eax
call esi
mov ebx, eax
test ebx, ebx
je 0x44b021
and dword [ebp - 0x38], 0
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
xor ebx, ebx
test eax, eax
je 0x44b015
cmp dword [ebp - 0x38], ebx
je 0x44b015
push str.GetNativeSystemInfo
push dword [ebp - 0x30]
call esi
cmp eax, ebx
je 0x44b015
lea ecx, [ebp - 0x5c]
push ecx
call eax
jmp 0x44b02d
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x44b02d
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ebx, ebx
mov cx, word [ebp - 0x5c]
movzx eax, cx
cmp eax, ebx
je 0x44b05d
cmp eax, 6
je 0x44b056
cmp eax, 9
jne 0x44b063
cmp word [ebp - 0x34], ax
je 0x44b04e
cmp word [ebp - 0x34], bx
jne 0x44b063
mov al, 1
call fcn.004b81ce
ret
cmp word [ebp - 0x34], 6
jmp 0x44b04c
cmp word [ebp - 0x34], cx
je 0x44b04e
mov eax, dword [edi]
push 0x1048
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, edi
call dword [eax + 0x2c]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
jne 0x44b08f
lea eax, [ebp - 0x2c]
push eax
mov ecx, 0x661
call fcn.00449a2b
pop ecx
cmp dword [ebp - 0x18], ebx
je 0x44b0ac
push 0x10
push ecx
mov eax, esp
mov dword [eax], ebx
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], esp
jae 0x44b0a5
lea eax, [ebp - 0x28]
push ecx
mov ecx, esp
mov dword [ecx], eax
jmp 0x44b0c3
push 0x10
push ecx
mov eax, esp
mov dword [ebp - 0x30], esp
mov dword [eax], 0x2797
push ecx
mov eax, esp
mov dword [eax], 0x2796
mov dword [ebp - 0x30], esp
push ebx
call fcn.0040fb91
add esp, 0x10
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.004035da
xor al, al
jmp 0x44b050

Function at 0x44e530
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d47d3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x52472c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.std::locale::_Locimp.0
mov dword [esp + 0x14], 1
push esi
call fcn.004afd50
add esp, 4
mov byte [esp + 0x14], 0
cmp dword [esi + 0x30], 0x10
jb 0x44e586
mov eax, dword [esi + 0x1c]
push eax
call fcn.004b1963
add esp, 4
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], 0
mov byte [esi + 0x1c], 0
mov dword [esp + 0x14], 0xffffffff
mov dword [esi], vtable.std::locale::facet.0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x457460
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d9b61
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
mov eax, dword [0x52472c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x40]
mov esi, ecx
push 0xffffffffffffffff
xor ebx, ebx
push ebx
lea eax, [esi + 4]
push eax
mov ecx, edi
mov dword [esp + 0x1c], ebx
call fcn.00403ffa
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
cmp eax, 5
push str._r_n_Stack_Trace__x86___r_n_r_n
sete byte [esp + 0x44]
call fcn.004b3310
add esp, 4
push eax
push str._r_n_Stack_Trace__x86___r_n_r_n
xor eax, eax
mov ecx, edi
call fcn.004096c8
cmp byte [esp + 0x40], bl
je 0x457518
lea ecx, [esp + 0x14]
push 0xfde9
push ecx
call fcn.00463aa0
add esp, 8
xor esi, esi
mov dword [esp + 0x38], esi
push 0xffffffffffffffff
push esi
push eax
mov ecx, ebp
call fcn.00403ffa
mov dword [esp + 0x38], 0xffffffff
cmp dword [esp + 0x2c], 8
jb 0x457512
mov edx, dword [esp + 0x18]
push edx
call fcn.004b1963
add esp, 4
mov dword [esp + 0x28], esi
jmp 0x457578
cmp eax, 0xffffffff
je 0x45753a
push eax
push 0
lea ecx, [esp + 0x1c]
push ecx
push edi
call fcn.0040d824
mov ebx, 1
mov dword [esp + 0x38], ebx
mov dword [esp + 0x10], ebx
jmp 0x45753c
mov eax, edi
push 0xffffffffffffffff
push 0
push eax
mov ecx, ebp
call fcn.00403ffa
mov dword [esp + 0x38], 0xffffffff
test bl, 1
je 0x457587
and ebx, 0xfffffffe
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x2c], 8
jb 0x457570
mov edx, dword [esp + 0x18]
push edx
call fcn.004b1963
add esp, 4
mov dword [esp + 0x28], 0
xor eax, eax
mov word [esp + 0x18], ax
mov dword [esp + 0x2c], 7
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 4

Function at 0x4583a0
Capabilities:
Create thread

Disassembly:
push esi
push edi
push 8
call fcn.004b32ab
mov ecx, dword [esp + 0x14]
add esp, 4
push 0
mov esi, eax
mov eax, dword [esp + 0x10]
push 0
push esi
push 0x4583f0
push 0
push 0
mov dword [esi], eax
mov dword [esi + 4], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x4583e0
push esi
call fcn.004b1963
add esp, 4
mov eax, edi
pop edi
pop esi
ret
Function at 0x459120
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4deb41
mov eax, dword fs:[0]
push eax
sub esp, 0x470
mov eax, dword [0x52472c]
xor eax, esp
mov dword [esp + 0x46c], eax
push ebx
push esi
push edi
mov eax, dword [0x52472c]
xor eax, esp
push eax
lea eax, [esp + 0x480]
mov dword fs:[0], eax
push 1
lea eax, [esp + 0x14]
push eax
xor eax, eax
mov esi, ecx
mov dword [esp + 0x18], 0x2a
call fcn.004096c8
cmp eax, 0xffffffff
jne 0x45919b
cmp dword [esi + 0x18], 8
jb 0x45918c
mov esi, dword [esi + 4]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4592c6
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4592c6
xor ebx, ebx
mov ecx, 0x5c
mov word [esp + 0x470], cx
mov dword [esp + 0x474], ebx
mov dword [esp + 0x478], ebx
mov dword [esp + 0x488], ebx
cmp dword [esi + 0x18], 8
jb 0x4591ca
mov eax, dword [esi + 4]
jmp 0x4591cd
lea eax, [esi + 4]
lea esi, [esp + 0x18]
call fcn.0045a330
cmp eax, ebx
je 0x459296
mov eax, dword [esp + 0x478]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, ebx
je 0x459224
mov ecx, dword [esp + 0x18]
shr ecx, 4
and ecx, 1
je 0x459220
cmp word [esp + 0x44], 0x2e
jne 0x459220
mov dx, word [esp + 0x46]
cmp dx, bx
je 0x459270
cmp dx, 0x2e
jne 0x459220
cmp word [esp + 0x48], bx
je 0x459270
cmp ecx, ebx
jne 0x459270
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.0045a020
mov byte [esp + 0x488], 1
mov ecx, dword [esp + 0x10]
push ecx
call esi
mov byte [esp + 0x488], bl
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x459269
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x478]
mov ecx, dword [esp + 0x474]
cmp ecx, ebx
je 0x459296
cmp eax, ebx
je 0x459296
lea edx, [esp + 0x18]
push edx
push ecx
call edi
mov dword [esp + 0x478], eax
cmp eax, ebx
jne 0x4591f5
mov dword [esp + 0x488], 0xffffffff
mov eax, dword [esp + 0x474]
mov dword [esp + 0x478], ebx
cmp eax, ebx
je 0x4592c6
cmp eax, 0xffffffff
je 0x4592c6
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [esp + 0x474], ebx
mov ecx, dword [esp + 0x480]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x46c]
xor ecx, esp
call fcn.004b196e
add esp, 0x47c
ret
Function at 0x4593b0
Capabilities:
Delete directory

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, eax
mov ebx, dword [esi + 0x28]
add esi, 0x18
push edi
cmp dword [esi + 0xc], ebx
jbe 0x4593c9
call fcn.004b3673
mov edi, dword [esi]
mov ebp, ebx
mov ebx, dword [esi + 0xc]
mov dword [esp + 0x14], ebx
cmp ebx, dword [esi + 0x10]
jbe 0x4593de
call fcn.004b3673
mov eax, dword [esi]
mov dword [esp + 0x18], eax
test edi, edi
je 0x4593ee
cmp edi, dword [esp + 0x18]
je 0x4593f3
call fcn.004b3673
cmp ebp, ebx
je 0x459466
mov dword [esp + 0x24], ebp
test edi, edi
jne 0x459433
call fcn.004b3673
xor eax, eax
cmp ebp, dword [eax + 0xc]
ja 0x459410
call fcn.004b3673
lea ebx, [ebp - 0x1c]
test edi, edi
jne 0x459437
call fcn.004b3673
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x459428
call fcn.004b3673
cmp dword [ebx + 0x18], 8
jb 0x45943b
mov eax, dword [ebx + 4]
jmp 0x45943e
mov eax, dword [edi]
jmp 0x459406
mov eax, dword [edi]
jmp 0x45941e
lea eax, [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test edi, edi
jne 0x459462
call fcn.004b3673
xor eax, eax
cmp ebp, dword [eax + 0xc]
ja 0x45945a
call fcn.004b3673
mov ebp, ebx
mov ebx, dword [esp + 0x14]
jmp 0x4593e4
mov eax, dword [edi]
jmp 0x459450
mov ebp, dword [esi + 0x10]
cmp dword [esi + 0xc], ebp
jbe 0x459473
call fcn.004b3673
mov edi, dword [esi + 0xc]
mov ebx, dword [esi]
cmp edi, dword [esi + 0x10]
jbe 0x459482
call fcn.004b3673
mov eax, dword [esi]
push ebp
push ebx
push edi
push eax
lea ecx, [esp + 0x30]
push ecx
call fcn.00459680
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x45ac30
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4d999c
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x52472c]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x5c]
push 1
lea eax, [esp + 0x18]
xor ebx, ebx
push eax
mov dword [esp + 0x18], ebx
call fcn.0045bc30
mov dword [esp + 0x54], 1
mov ecx, dword [esp + 0x24]
sub ecx, dword [esp + 0x20]
sar ecx, 1
jne 0x45ac85
call fcn.004b3673
mov edx, dword [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
push edx
push ebx
call esi
inc eax
lea ecx, [esp + 0x14]
call fcn.0045bda0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, eax
sub edx, ecx
sar edx, 1
jne 0x45acba
call fcn.004b3673
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
sub eax, ecx
sar eax, 1
push ecx
push eax
call esi
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
sub ecx, edx
sar ecx, 1
cmp eax, ecx
jbe 0x45acee
push edi
call fcn.0045a500
mov dword [esp + 0x10], 1
mov byte [esp + 0x54], bl
lea eax, [esp + 0x14]
push eax
jmp 0x45ad70
cmp ecx, ebx
ja 0x45acfb
call fcn.004b3673
mov edx, dword [esp + 0x20]
xor ecx, ecx
push edx
mov esi, edx
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], ebx
mov word [esp + 0x34], cx
call fcn.004b3310
add esp, 4
push eax
push esi
lea ecx, [esp + 0x34]
call fcn.004042c6
mov byte [esp + 0x54], 2
push edi
lea ecx, [esp + 0x30]
call fcn.0045a5d0
mov dword [esp + 0x10], 1
mov byte [esp + 0x54], 1
cmp dword [esp + 0x44], 8
jb 0x45ad54
mov edx, dword [esp + 0x30]
push edx
call fcn.004b1963
add esp, 4
xor eax, eax
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], ax
mov byte [esp + 0x54], bl
lea ecx, [esp + 0x14]
push ecx
call fcn.0045cbd0
mov eax, edi
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x48
ret