joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43eca5
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push edi
mov edi, ecx
call fcn.0043ef10
call dword [sym.imp.USER32.dll_CountClipboardFormats]
test eax, eax
jne 0x43ecc4
mov al, 1
jmp 0x43ee4e
push ebx
push dword [ebp + 8]
xor ebx, ebx
lea ecx, [ebp - 1]
mov byte [ebp - 1], bl
call fcn.0043be07
test al, al
je 0x43ee3f
push esi
call fcn.0043ef30
mov dword [ebp - 8], eax
push ebx
jmp 0x43ee2c
cmp esi, 2
je 0x43ee2b
cmp esi, 3
je 0x43ee2b
cmp esi, 9
je 0x43ee2b
cmp esi, 0x80
je 0x43ee2b
cmp esi, 0xe
je 0x43ee2b
cmp esi, 0x8e
je 0x43ee2b
cmp esi, 0x83
je 0x43ee2b
cmp esi, 0x82
je 0x43ee2b
cmp esi, 0x200
jb 0x43ed54
cmp esi, 0x2ff
jbe 0x43ee2b
push esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp + 8], eax
test eax, eax
je 0x43ee2b
call fcn.0043ef30
cmp dword [ebp - 8], eax
jne 0x43ee53
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov ecx, eax
mov dword [ebp - 0xc], ecx
lea eax, [ecx - 1]
cmp eax, 0x3ffffe
ja 0x43ee2b
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x43ee2b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x43edfa
test ecx, ecx
je 0x43edea
mov edx, dword [ebp - 0x10]
push eax
test edx, edx
je 0x43ede0
push edx
push ecx
call fcn.004c0200
add esp, 0xc
jmp 0x43edfa
push ebx
push ecx
call fcn.004b6620
add esp, 0xc
call fcn.004c0b08
mov dword [eax], 0x16
call fcn.004c09e2
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ecx
push dword [edi + 4]
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.0043f019
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x43ee26
mov dword [ecx], eax
jmp 0x43ee28
mov dword [edi], eax
mov dword [edi + 4], eax
push esi
call dword [sym.imp.USER32.dll_EnumClipboardFormats]
mov esi, eax
test esi, esi
jne 0x43ecec
mov bl, 1
pop esi
cmp byte [ebp - 1], 0
je 0x43ee4b
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, bl
pop ebx
pop edi
leave
ret 4
mov ecx, edi
call fcn.0043ef10
jmp 0x43ee3e

Function at 0x43ee5c
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
push dword [ebp + 8]
mov edi, ecx
xor ebx, ebx
lea ecx, [ebp - 1]
mov byte [ebp - 1], bl
call fcn.0043be07
test al, al
je 0x43eeae
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov esi, dword [edi]
jmp 0x43eea0
lea ebx, [esi]
mov esi, dword [esi]
push dword [ebx + 0xc]
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x43eea0
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test esi, esi
jne 0x43ee83
mov ecx, edi
call fcn.0043ef96
mov bl, 1
pop esi
cmp byte [ebp - 1], 0
je 0x43eeba
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov al, bl
pop ebx
leave
ret 4
Function at 0x445bb9
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x54300c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx]
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x20], ebx
call dword [eax + 0xc]
mov ecx, dword [edi]
cmp dword [ecx - 0xc], ebx
je 0x445d50
mov eax, dword [esi]
cmp dword [eax - 0xc], ebx
je 0x445d50
push ecx
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.00401f21
mov esi, dword [ebp - 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x445cb3
mov dword [ebp - 0x1c], ebx
call fcn.00402cbd
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402161
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov ecx, eax
cmp word [ecx], bx
je 0x445c6b
sub ecx, esi
sar ecx, 1
cmp ecx, 0xffffffff
je 0x445c6b
mov eax, dword [esi - 0xc]
sub eax, ecx
push eax
push ecx
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 8]
call fcn.0041b7e1
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00401ec9
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.004033d1
mov edi, dword [ebp - 0x1c]
xor eax, eax
inc eax
push str..xdxf
push edi
mov dword [ebp - 0x20], eax
call fcn.004dcf3a
pop ecx
pop ecx
test eax, eax
jne 0x445cb6
push ecx
push ecx
mov ecx, dword [ebp - 0x28]
inc eax
push 0x80
push 3
mov dword [ebp - 0x20], eax
add ecx, 0x48
mov eax, dword [ebp - 0x30]
push 1
push closesocket
push dword [eax]
call fcn.0043de3b
test eax, eax
jne 0x445cb6
mov byte [ebp - 0x15], bl
inc eax
jmp 0x445cbd
mov edi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov byte [ebp - 0x15], 1
test al, 1
je 0x445cc9
lea ecx, [edi - 0x10]
call fcn.004033d1
cmp byte [ebp - 0x15], bl
jne 0x445d44
mov eax, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x28]
push dword [eax]
lea ecx, [edi + 0x50]
call fcn.00447ed7
test al, al
je 0x445d35
mov eax, dword [edi + 0x6c]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 0x70]
mov dword [ebp - 0x10], eax
lea eax, [edi + 4]
push eax
mov dword [ebp - 0xc], ebx
call fcn.00448843
test al, al
je 0x445d35
lea eax, [edi + 8]
push eax
lea ecx, [ebp - 0x14]
call fcn.00448843
test al, al
je 0x445d35
lea eax, [edi + 0xc]
push eax
lea ecx, [ebp - 0x14]
call fcn.00448843
test al, al
je 0x445d35
lea eax, [edi + 0x10]
push eax
lea ecx, [ebp - 0x14]
call fcn.00448843
test al, al
je 0x445d35
mov bl, 1
jmp 0x445d44
push dword [ebp - 0x2c]
mov ecx, edi
push dword [ebp - 0x30]
call fcn.0044600a
mov bl, al
lea ecx, [esi - 0x10]
call fcn.004033d1
mov al, bl
jmp 0x445d52
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b3dd4
leave
ret 8
Function at 0x447df1
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x54300c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, ecx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], eax
call fcn.00447f72
push ecx
push ecx
push 0
push 2
push 0
push 0x40000000
push ebx
mov ecx, esi
call fcn.0043de3b
test eax, eax
jne 0x447ec4
xor ecx, ecx
xor ebx, ebx
mov dword [esi + 0x10], ecx
inc ebx
and dword [esi + 0x18], ecx
mov ecx, esi
push dword [ebp - 8]
mov dword [esi + 8], 0x49445451
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], 0x10000
mov eax, dword [edi + 4]
mov dword [esi + 0x18], eax
call fcn.00447fb8
test al, al
je 0x447eb4
xor eax, eax
mov ecx, esi
push eax
push eax
push eax
call fcn.00445ac8
test eax, eax
jne 0x447eb4
lea eax, [ebp - 8]
mov ecx, esi
push eax
push 0x14
lea eax, [esi + 8]
push eax
call fcn.0043dec9
test eax, eax
jne 0x447eb4
cmp dword [ebp - 8], 0x14
jne 0x447eb4
lea eax, [ebp - 8]
mov ecx, esi
push eax
push dword [edi + 4]
push dword [edi]
call fcn.0043dec9
test eax, eax
jne 0x447eae
mov eax, dword [ebp - 8]
cmp eax, dword [edi + 4]
je 0x447eb0
xor bl, bl
mov al, bl
jmp 0x447ec6
mov ecx, esi
call fcn.00447f72
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b3dd4
leave
ret 0x10

Function at 0x4483a9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x54300c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov edi, ecx
cmp dword [edi], ebx
je 0x44841d
movzx edx, word [ebp + 8]
mov eax, dword [edi + 0x18]
dec edx
imul edx, dword [edi + 0x14]
push ebx
push ebx
add edx, 0x14
add eax, edx
push eax
call fcn.00445ac8
test eax, eax
jne 0x44841d
push ebx
lea eax, [ebp - 8]
push eax
push dword [esi + 4]
push dword [esi]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x448402
call fcn.0043e203
test eax, eax
jne 0x44841d
mov eax, dword [esi + 4]
cmp dword [ebp - 8], eax
jne 0x44841d
cmp eax, 0xc
jbe 0x448419
lea edi, [esi + 8]
mov bl, 1
mov esi, dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov al, bl
jmp 0x44841f
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b3dd4
leave
ret 8
Function at 0x44a201
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, ecx
push edi
push 0x50
mov dword [ebp - 0xc], ebx
call esi
xor ecx, ecx
test eax, eax
je 0x44a234
push 0x4c
call esi
push 0x4d
mov dword [ebx], eax
call esi
push 0x4e
mov dword [ebx + 4], eax
call esi
push 0x4f
jmp 0x44a23e
push ecx
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
call esi
push 1
mov dword [ebx + 8], eax
call esi
mov edi, eax
mov dword [ebx + 0xc], edi
mov eax, dword [ebx + 8]
sub eax, dword [ebx]
mov dword [ebp - 4], eax
test eax, eax
jle 0x44a2d3
sub edi, dword [ebx + 4]
mov dword [ebp - 0x10], edi
test edi, edi
jle 0x44a2d3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.USER32.dll_GetWindowDC]
mov esi, eax
push esi
mov dword [ebp - 8], esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push edi
push dword [ebp - 4]
mov ebx, eax
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push ebx
mov dword [ebp - 0x18], eax
call edi
push 0x40cc0020
mov esi, eax
mov eax, dword [ebp - 0xc]
push dword [eax + 4]
push dword [eax]
push dword [ebp - 8]
push dword [ebp - 0x10]
push dword [ebp - 4]
push 0
push 0
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
push ebx
call edi
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 8]
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp - 0x18]
jmp 0x44a2d5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x450a0e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
push 0x3c
lea eax, [ebp - 0x3c]
mov edi, edx
push 0
push eax
mov esi, ecx
call fcn.004b6620
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
cmp dword [ebp + 8], 0
mov eax, str.open
mov dword [ebp - 0x38], 0x900400
cmovne eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
pop edi
setne al
pop esi
leave
ret

Function at 0x450a68
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
push 0x3c
lea eax, [ebp - 0x3c]
mov edi, edx
push 0
push eax
mov esi, ecx
call fcn.004b6620
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x30], str.runas
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
pop edi
setne al
pop esi
leave
ret
Function at 0x450b17
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push esi
push edi
mov edi, ecx
mov esi, edx
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x450b41
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x450b41
mov edx, dword [esi]
mov ecx, dword [edi]
push 0
call fcn.00450a0e
pop ecx
test al, al
jne 0x450b4a
mov ecx, dword [esi]
pop edi
pop esi
jmp fcn.00450ac2
pop edi
pop esi
ret
Function at 0x453c8b
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
push ebx
push esi
push edi
call fcn.0045c2f4
test al, al
je 0x453e92
call fcn.00402cbd
push eax
lea ecx, [esp + 0x14]
call fcn.00402161
lea ecx, [esp + 0x10]
call fcn.0045b288
test al, al
je 0x453e82
mov esi, 0x522230
mov ecx, esi
call fcn.0040208a
push eax
push esi
lea ecx, [esp + 0x18]
call fcn.00402366
mov edi, dword [esp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
push edi
push 4
pop edx
call fcn.0044b269
pop ecx
pop ecx
test al, al
je 0x453e86
mov ecx, dword [0x5494ec]
lea ecx, [ecx - 0x10]
call fcn.004021de
xor ebx, ebx
lea esi, [eax + 0x10]
mov dword [esp + 0x14], esi
cmp dword [esi - 0xc], ebx
jne 0x453d2d
mov esi, str.f2fc8eb54888957
mov ecx, esi
call fcn.0040208a
push eax
push esi
lea ecx, [esp + 0x1c]
call fcn.00402231
mov esi, dword [esp + 0x14]
or dword [esp + 0x40], 0xffffffff
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 0x11
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], 0xa
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x34], 0x3f400000
mov dword [esp + 0x38], 0x3e800000
mov dword [esp + 0x3c], 0x40100000
call fcn.00454f3e
lea eax, [esp + 0x14]
push eax
push str.apikey
lea ecx, [esp + 0x30]
call fcn.004548b2
mov ecx, eax
call fcn.00401ec9
lea eax, [esp + 0x10]
push eax
push str.file
lea ecx, [esp + 0x30]
call fcn.004548b2
mov ecx, eax
call fcn.00401ec9
push dword [ebp + 0xc]
call fcn.00453f92
push eax
push str.language
lea ecx, [esp + 0x30]
call fcn.004548b2
mov ecx, eax
call fcn.00401ea9
push 0x529b54
push str.filetype
lea ecx, [esp + 0x30]
call fcn.004548b2
mov ecx, eax
call fcn.0041bb3d
push str.true
push str.scale
lea ecx, [esp + 0x30]
call fcn.004548b2
mov ecx, eax
call fcn.0041bb3d
push str.https:__api.ocr.space_parse_image
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call fcn.00401f21
lea eax, [esp + 0x18]
push eax
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x18]
call fcn.0045c030
pop ecx
mov ecx, dword [esp + 0x14]
mov bl, al
lea ecx, [ecx - 0x10]
call fcn.004033d1
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp + 0x10]
mov edx, dword [esp + 0x1c]
mov ecx, 0xfde9
push dword [esp + 0x20]
call fcn.0043b185
cmp dword [esp + 0x20], 0
pop ecx
pop ecx
je 0x453e6f
push dword [esp + 0x18]
call fcn.004c0774
pop ecx
lea ecx, [esp + 0x28]
call fcn.00454a1a
lea ecx, [esi - 0x10]
call fcn.004033d1
jmp 0x453e88
mov edi, dword [esp + 0x10]
xor bl, bl
lea ecx, [edi - 0x10]
call fcn.004033d1
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45a31d
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push 0x2001f
xor ebx, ebx
lea ecx, [ebp - 0x10]
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.gdiplus.dll_Ordinal_1
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call fcn.0043dd98
mov esi, dword [ebp - 0x10]
test eax, eax
jne 0x45a420
cmp byte [ebp + 8], bl
je 0x45a414
mov ecx, dword [0x549184]
lea eax, [ebp + 8]
push eax
call fcn.0043ca23
push eax
lea ecx, [ebp - 0x54]
call fcn.0043c61e
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.004033d1
push str.startup_minimized
lea ecx, [ebp - 4]
call fcn.00401f21
call fcn.00402cbd
push eax
lea ecx, [ebp + 8]
call fcn.00402161
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x54]
call fcn.0043cbef
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.004033d1
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.004033d1
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x54]
call fcn.0043c826
mov edx, dword [eax]
test edx, edx
je 0x45a3ff
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x45a3d7
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push ebx
push 0x522768
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.004033d1
lea ecx, [ebp - 0x54]
call fcn.0043c67a
jmp 0x45a420
push 0x522768
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test esi, esi
je 0x45a42b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
leave
ret 4
Function at 0x45a431
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x54300c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x20019
xor ebx, ebx
lea ecx, [ebp - 0x224]
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.gdiplus.dll_Ordinal_1
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], ebx
call fcn.0043dd98
test eax, eax
jne 0x45a590
lea eax, [ebp - 0x218]
mov edi, 0x104
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x218], edi
push eax
push 0x522768
lea ecx, [ebp - 0x224]
call fcn.0043dca3
test eax, eax
jne 0x45a590
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x210]
call fcn.00401f21
push 0x44
call fcn.004b3df0
mov ecx, eax
call fcn.0043c5d0
mov esi, eax
lea eax, [ebp - 0x210]
push eax
mov ecx, esi
call fcn.0043cd68
mov ecx, dword [ebp - 0x210]
add ecx, 0xfffffff0
mov dword [ebp - 0x218], esi
call fcn.004033d1
lea eax, [ebp - 0x210]
mov ecx, esi
push eax
call fcn.0043ca23
call fcn.00402cbd
push eax
lea ecx, [ebp - 0x214]
call fcn.00402161
push 0x105
lea ecx, [ebp - 0x214]
call fcn.0040335d
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, eax
lea ecx, [ebp - 0x214]
push esi
call fcn.004033a6
test esi, esi
je 0x45a569
mov esi, dword [ebp - 0x214]
lea ecx, [ebp - 0x210]
push esi
call fcn.00401fc2
mov ebx, eax
lea ecx, [esi - 0x10]
neg ebx
sbb bl, bl
inc bl
call fcn.004033d1
mov ecx, dword [ebp - 0x210]
add ecx, 0xfffffff0
jmp 0x45a580
mov ecx, dword [ebp - 0x214]
lea ecx, [ecx - 0x10]
call fcn.004033d1
mov ecx, dword [ebp - 0x210]
lea ecx, [ecx - 0x10]
call fcn.004033d1
lea ecx, [ebp - 0x218]
call fcn.0043d722
cmp dword [ebp - 0x224], 0
je 0x45a5a5
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b3dd4
leave
ret

Function at 0x45b4df
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, ecx
call fcn.00402cbd
push eax
lea ecx, [ebp - 4]
call fcn.00402161
lea ecx, [ebp - 4]
call fcn.0045b41d
test al, al
je 0x45b54e
push str.Default.ico
lea ecx, [ebp - 8]
call fcn.00401f21
lea edx, [ebp - 8]
lea ecx, [ebp - 4]
call fcn.0045b9d9
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.004033d1
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x45b551
push ecx
push 0x10
pop edx
mov ecx, 0xbb
call fcn.00454396
pop ecx
push esi
mov ecx, eax
call fcn.00449e28
pop ecx
jmp 0x45b551
mov esi, dword [ebp - 4]
lea ecx, [esi - 0x10]
call fcn.004021de
add eax, 0x10
lea ecx, [esi - 0x10]
mov dword [edi], eax
call fcn.004033d1
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x45b78e
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, ecx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45b7a2
mov al, 1
pop esi
ret
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
pop esi
setne al
ret
Function at 0x45b81b
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x54300c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x264], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
test eax, eax
jne 0x45b849
xor al, al
jmp 0x45b9a4
push ecx
xor ebx, ebx
mov ecx, eax
push ebx
call fcn.0041fa3d
mov eax, dword [edi]
mov ecx, 0x529ddc
cmp dword [eax - 0xc], ebx
cmovne ecx, eax
push ecx
lea ecx, [ebp - 0x25c]
call fcn.00401f21
lea eax, [ebp - 0x25c]
mov edx, esi
push eax
lea ecx, [ebp - 0x260]
call fcn.0045b9fe
pop ecx
mov ecx, dword [ebp - 0x25c]
lea ecx, [ecx - 0x10]
call fcn.004033d1
push 0x250
lea eax, [ebp - 0x258]
push ebx
push eax
call fcn.004b6620
mov esi, dword [ebp - 0x260]
lea eax, [ebp - 0x258]
add esp, 0xc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x45b8cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
sete bl
jmp 0x45b99a
mov edi, dword [ebp - 0x264]
xor ebx, ebx
inc ebx
mov esi, eax
mov eax, dword [ebp - 0x258]
shr eax, 4
test al, 1
je 0x45b965
cmp dword [ebp + 8], 0
je 0x45b97e
mov ecx, 0x529de0
lea eax, [ebp - 0x22c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x45b922
test dx, dx
je 0x45b91e
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x45b922
add eax, 4
add ecx, 4
test dx, dx
jne 0x45b8fc
xor eax, eax
jmp 0x45b926
sbb eax, eax
or eax, ebx
test eax, eax
je 0x45b97e
mov ecx, 0x529de4
lea eax, [ebp - 0x22c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x45b95b
test dx, dx
je 0x45b957
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x45b95b
add eax, 4
add ecx, 4
test dx, dx
jne 0x45b935
xor eax, eax
jmp 0x45b95f
sbb eax, eax
or eax, ebx
test eax, eax
jne 0x45b970
jmp 0x45b97e
not al
test al, 1
je 0x45b970
cmp dword [ebp + 8], ebx
je 0x45b97e
lea eax, [ebp - 0x22c]
mov ecx, edi
push eax
call fcn.0041e3a3
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x45b8da
mov esi, dword [ebp - 0x260]
lea ecx, [esi - 0x10]
call fcn.004033d1
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b3dd4
leave
ret
Function at 0x45d024
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push esi
push edi
push 0x10
mov ecx, dword [eax]
pop edi
sub ecx, edi
call fcn.004021de
add eax, edi
lea ecx, [ebp + 8]
push str.Service.ico
mov dword [ebp - 4], eax
call fcn.00401f21
lea edx, [ebp + 8]
lea ecx, [ebp - 4]
call fcn.0045b9d9
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.004033d1
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x45d074
xor edi, edi
jmp 0x45d089
push 0x30
push edi
push edi
push 1
push esi
push dword [0x547d9c]
call dword [sym.imp.USER32.dll_LoadImageW]
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.004033d1
mov eax, edi
pop edi
pop esi
leave
ret 4

Function at 0x45d099
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
lea ecx, [ebp + 8]
push ebx
push esi
push edi
push 1
call fcn.0045d34b
mov esi, dword [ebp + 8]
pop ecx
push esi
lea ecx, [ebp + 8]
call fcn.00401f21
lea ecx, [esi - 0x10]
call fcn.004033d1
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x45d137
mov edi, dword [ebp + 0xc]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45d126
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push eax
push dword [edi]
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromFile]
mov edi, dword [ebp + 8]
test eax, eax
je 0x45d100
push edi
call dword [sym.imp.gdiplus.dll_GdipDisposeImage]
jmp 0x45d126
lea eax, [ebp + 0xc]
push eax
push edi
call dword [sym.imp.gdiplus.dll_GdipCreateHICONFromBitmap]
test eax, eax
jne 0x45d0f7
mov ecx, dword [ebp + 0xc]
push esi
call fcn.00449e28
pop ecx
push edi
mov bl, al
call dword [sym.imp.gdiplus.dll_GdipDisposeImage]
test bl, bl
jne 0x45d137
push ecx
push 0x10
pop edx
mov ecx, 0xbb
call fcn.00454396
pop ecx
jmp 0x45d14c
push 0x30
push 0x10
push 0x10
push 1
push esi
push dword [0x547d9c]
call dword [sym.imp.USER32.dll_LoadImageW]
lea ecx, [esi - 0x10]
mov edi, eax
call fcn.004033d1
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8