joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43fb60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4e7d04]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x218], ecx
push 0x208
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.00482260
add esp, 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 0x214], 0x104
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 4]
push eax
push 0x4c2eb4
push 0x4c2ee8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x43fbf2
push 0x4c2ecc
lea ecx, [ebp - 0x210]
push ecx
call fcn.00488d8f
add esp, 8
test eax, eax
jne 0x43fbf2
mov edx, dword [ebp - 0x218]
mov dword [edx + 0x28], 1
jmp 0x43fc68
push 0x4c2f6c
mov eax, dword [ebp - 0x218]
add eax, 0x20
push eax
call fcn.00402dc0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x43fc5b
push 0x4c2f7c
mov edx, dword [ebp - 0x218]
add edx, 0x20
push edx
call fcn.00402dc0
add esp, 8
movzx eax, al
test eax, eax
je 0x43fc5b
push 0x4c2f8c
mov ecx, dword [ebp - 0x218]
add ecx, 0x20
push ecx
call fcn.00402dc0
add esp, 8
movzx edx, al
test edx, edx
je 0x43fc5b
mov eax, dword [ebp - 0x218]
mov dword [eax + 0x28], 1
jmp 0x43fc68
mov ecx, dword [ebp - 0x218]
mov dword [ecx + 0x28], 0
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004820d9
mov esp, ebp
pop ebp
ret

Function at 0x442d30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 4
push 0x4c30d0
push 0
call fcn.00474a50
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 6
jne 0x442d63
push 1
push 0
push 0
push str.http:__down.360safe.com_bizhi_360wallpaper_bird.exe
push 0x4c3168
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret
Function at 0x443540
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b9ef4
mov eax, dword fs:[0]
push eax
sub esp, 0x43c
mov eax, dword [0x4e7d04]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x228], 4
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x440], 4
lea eax, [ebp - 0x440]
push eax
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x228]
push edx
push 0x4c38d8
push 0x4c38f0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4435cc
cmp dword [ebp - 0x224], 1
jne 0x4435cc
jmp 0x443776
push 0x208
push 0
lea eax, [ebp - 0x43c]
push eax
call fcn.00482260
add esp, 0xc
mov dword [ebp - 0x228], 1
mov dword [ebp - 0x440], 0x104
mov dword [ebp - 0x230], 0x4c3978
lea ecx, [ebp - 0x440]
push ecx
lea edx, [ebp - 0x43c]
push edx
lea eax, [ebp - 0x228]
push eax
push 0x4c39fc
mov ecx, dword [ebp - 0x230]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x443635
jmp 0x443776
push 0x4c3a08
lea edx, [ebp - 0x43c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x43c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x44365d
jmp 0x443776
push 0x208
push 0
lea ecx, [ebp - 0x21c]
push ecx
call fcn.00482260
add esp, 0xc
push 0x104
lea edx, [ebp - 0x21c]
push edx
mov eax, dword [0x4ea740]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x220]
call fcn.00404750
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x43c]
push ecx
lea ecx, [ebp - 0x444]
call fcn.00403ac0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x444]
push eax
call fcn.00420710
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x444]
call fcn.00404680
lea ecx, [ebp - 0x22c]
call fcn.00404750
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x448]
call fcn.00403ac0
mov byte [ebp - 4], 3
lea edx, [ebp - 0x22c]
push edx
lea eax, [ebp - 0x448]
push eax
call fcn.00420710
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x448]
call fcn.00404680
lea ecx, [ebp - 0x220]
call fcn.00402e20
push eax
lea ecx, [ebp - 0x22c]
call fcn.00402e20
push eax
call fcn.00461870
add esp, 8
test eax, eax
jge 0x44374d
mov dword [ebp - 0x10], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x22c]
call fcn.00404680
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.00404680
xor ecx, ecx
jne 0x443572
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004820d9
mov esp, ebp
pop ebp
ret
Function at 0x4437a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x640
mov eax, dword [0x4e7d04]
xor eax, ebp
mov dword [ebp - 0xc], eax
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.00482260
add esp, 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 0x21c], 0x104
mov dword [ebp - 8], 0x4c3a28
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 4]
push eax
push 0x4c3aac
mov ecx, dword [ebp - 8]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4438c1
push 0x4c3ab8
lea ecx, [ebp - 0x634]
call fcn.00403ac0
lea edx, [ebp - 0x634]
push edx
call fcn.0040f020
mov ecx, eax
call fcn.0046c610
lea ecx, [ebp - 0x634]
call fcn.00404680
push 0x4c3ac8
call fcn.0040f020
mov ecx, eax
call fcn.0046c6b0
push 0x208
push 0
lea eax, [ebp - 0x428]
push eax
call fcn.00482260
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x428]
push ecx
mov edx, dword [0x4ea740]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x428]
push eax
call fcn.0040f020
mov ecx, eax
call fcn.0046c630
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x638], esp
push 0
call fcn.0040f0b0
push 0
push 0
push 0x4c3ad4
call fcn.0040f020
mov ecx, eax
call fcn.0046c540
mov eax, 2
jmp 0x4439b2
push 1
call fcn.004619f0
add esp, 4
test eax, eax
jne 0x443982
push 0x4c3ae8
lea ecx, [ebp - 0x63c]
call fcn.00403ac0
lea ecx, [ebp - 0x63c]
push ecx
call fcn.0040f020
mov ecx, eax
call fcn.0046c610
lea ecx, [ebp - 0x63c]
call fcn.00404680
push 0x4c3af8
call fcn.0040f020
mov ecx, eax
call fcn.0046c6b0
push 0x208
push 0
lea edx, [ebp - 0x630]
push edx
call fcn.00482260
add esp, 0xc
push 0x104
lea eax, [ebp - 0x630]
push eax
mov ecx, dword [0x4ea740]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x630]
push edx
call fcn.0040f020
mov ecx, eax
call fcn.0046c630
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x640], esp
push 0
call fcn.0040f0b0
push 0
push 0
push 0x4c3b04
call fcn.0040f020
mov ecx, eax
call fcn.0046c540
mov eax, 1
jmp 0x4439b2
cmp dword [0x4ea744], 0
jne 0x4439ad
mov eax, dword [0x4ea744]
add eax, 1
mov dword [0x4ea744], eax
push 0
push str._s___pidludashi
push 0
mov ecx, dword [0x4ea740]
push ecx
call main
mov eax, dword [0x4e41a0]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004820d9
mov esp, ebp
pop ebp
ret
Function at 0x4439c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x638
mov eax, dword [0x4e7d04]
xor eax, ebp
mov dword [ebp - 0xc], eax
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.00482260
add esp, 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 0x21c], 0x104
mov dword [ebp - 8], 0x4c3b38
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 4]
push eax
push 0x4c3bbc
mov ecx, dword [ebp - 8]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x443adc
mov edx, dword [ebp + 8]
push edx
call fcn.0040f180
mov ecx, eax
call fcn.0043f0a0
call fcn.0040f180
mov ecx, eax
call fcn.0043fa50
push eax
call fcn.0040f020
mov ecx, eax
call fcn.0046c610
push 0x4c3bc8
call fcn.0040f020
mov ecx, eax
call fcn.0046c6b0
push 0x208
push 0
lea eax, [ebp - 0x428]
push eax
call fcn.00482260
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x428]
push ecx
mov edx, dword [0x4ea740]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x428]
push eax
call fcn.0040f020
mov ecx, eax
call fcn.0046c630
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x634], esp
push 0
call fcn.0040f0b0
push 0
push 0
push str.exist_wp
call fcn.0040f020
mov ecx, eax
call fcn.0046c540
mov eax, 2
jmp 0x443bc7
push 1
call fcn.004619f0
add esp, 4
test eax, eax
jne 0x443b98
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040f180
mov ecx, eax
call fcn.0043f0a0
call fcn.0040f180
mov ecx, eax
call fcn.0043fa50
push eax
call fcn.0040f020
mov ecx, eax
call fcn.0046c610
push 0x4c3be8
call fcn.0040f020
mov ecx, eax
call fcn.0046c6b0
push 0x208
push 0
lea edx, [ebp - 0x630]
push edx
call fcn.00482260
add esp, 0xc
push 0x104
lea eax, [ebp - 0x630]
push eax
mov ecx, dword [0x4ea740]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x630]
push edx
call fcn.0040f020
mov ecx, eax
call fcn.0046c630
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x638], esp
push 0
call fcn.0040f0b0
push 0
push 0
push str.giveup
call fcn.0040f020
mov ecx, eax
call fcn.0046c540
mov eax, 1
jmp 0x443bc7
cmp dword [0x4ea744], 0
jne 0x443bc2
mov eax, dword [0x4ea744]
add eax, 1
mov dword [0x4ea744], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
mov edx, dword [0x4ea740]
push edx
call main
mov eax, dword [0x4e41a0]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004820d9
mov esp, ebp
pop ebp
ret
Function at 0x443be0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.00444320
add esp, 4
push 0x4c3c04
push 0
call fcn.00484110
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0x4c3c08
call fcn.00449630
add esp, 8
push 0
mov eax, dword [0x4ea740]
push eax
push 0
mov ecx, 0x4ea748
call fcn.00444570
mov dword [ebp - 8], eax
lea ecx, [ebp - 4]
call fcn.00466cb0
call fcn.00431370
mov ecx, eax
call fcn.00431270
call fcn.00443e90
mov ecx, eax
call fcn.004746b0
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0040f180
mov ecx, eax
call fcn.0043f0a0
call fcn.0040f180
mov ecx, eax
call fcn.0043fa10
mov edx, dword [eax]
push edx
call fcn.00474a40
mov ecx, 0x4ea784
call fcn.00467400
test eax, eax
jne 0x443cb5
push str.CheckSingleInstance_failed__exit
call fcn.00449630
add esp, 4
push 0
push 0x4c3c74
push 0
call fcn.00474a50
jmp 0x443d64
call fcn.00443540
test eax, eax
jne 0x443cd1
push 0
push 0x4c3c90
push 0
call fcn.00474a50
jmp 0x443d64
call fcn.004434b0
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0
call fcn.0040f0b0
push 0
push 0
push str.install_1
call fcn.0040f020
mov ecx, eax
call fcn.0046c540
call fcn.00442d70
test eax, eax
jne 0x443d1a
mov ecx, 0x4ea784
call fcn.00466f00
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x443d64
call fcn.004432d0
test eax, eax
jne 0x443d49
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0
call fcn.0040f0b0
push 0
push 0
push str.install_file_fail
call fcn.0040f020
mov ecx, eax
call fcn.0046c540
jmp 0x443d64
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00442a90
add esp, 8
mov dword [ebp - 0xc], eax
xor edx, edx
jne 0x443c87
call fcn.00443e90
mov ecx, eax
call fcn.004749d0
call fcn.00431370
mov ecx, eax
call fcn.00431360
call fcn.0040f0f0
mov ecx, eax
call fcn.004739a0
mov ecx, 0x4ea784
call fcn.00466f00
mov ecx, 0x4ea748
call fcn.00444730
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 4]
call fcn.00466cd0
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x447d00
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4e7d04]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], ecx
lea ecx, [ebp - 0x14]
call fcn.0041e030
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0041df80
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x447d6b
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x14]
call fcn.0041e010
mov eax, dword [ebp - 0x224]
jmp 0x447dfc
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x447dd1
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00447d00
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x447dc8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x228], edx
lea ecx, [ebp - 0x14]
call fcn.0041e010
mov eax, dword [ebp - 0x228]
jmp 0x447dfc
mov dword [ebp - 4], 0x100
jmp 0x447d72
lea ecx, [ebp - 0x14]
call fcn.0041dfe0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x230]
call fcn.00447bf0
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x14]
call fcn.0041e010
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004820d9
mov esp, ebp
pop ebp
ret 4
Function at 0x448390
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0x448399
xor ecx, ecx
jne 0x448399
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x4483ba
mov eax, 0xd
jmp 0x448415
xor eax, eax
jne 0x4483a1
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax*2]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2]
mov dword [ebp - 4], edx
cmp dword [ebp - 0xc], 1
jne 0x4483cb
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8

Function at 0x44b0c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 1
push 0
push 0
push str.http:__www.birdpaper.cn_index_user_agreement
push 0x4c41fc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x44dbc0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
call fcn.0044f720
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
mov edx, dword [eax + 0x40]
call edx
cmp dword [ebp - 4], 1
jne 0x44dd40
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x80], 0
je 0x44dd40
lea ecx, [ebp + 8]
push ecx
mov ecx, dword [ebp - 0xc]
add ecx, 4
call fcn.00450aa0
mov ecx, dword [ebp - 0xc]
call fcn.0044c0b0
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [eax + 0xf4]
call ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x44dc58
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [eax + 0x84]
call edx
test eax, eax
je 0x44dd40
mov dword [ebp - 4], 2
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
neg eax
sbb eax, eax
neg eax
je 0x44dca8
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 0x70], 0
jne 0x44dca8
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x70], 1
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x74], 0
push 1
push 0
push 0x3401
mov ecx, dword [ebp - 0xc]
add ecx, 4
call fcn.004197c0
jmp 0x44dcce
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 0x70], 0
je 0x44dcce
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x74], 0
jne 0x44dcce
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x70], 0
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x74], 1
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx edx, ax
and edx, 0x8000
neg edx
sbb edx, edx
neg edx
je 0x44dd1a
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x78], 0
jne 0x44dd1a
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x78], 1
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x74], 0
push 1
push 1
push 0x3401
mov ecx, dword [ebp - 0xc]
add ecx, 4
call fcn.004197c0
jmp 0x44dd40
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x78], 0
je 0x44dd40
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 0x74], 0
jne 0x44dd40
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x78], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x74], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x4533e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
xor eax, eax
jne 0x4533e9
xor ecx, ecx
jne 0x4533e9
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x453422
call fcn.00423ab0
jmp 0x453438
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
je 0x453436
push 0x26
call fcn.004459e0
add esp, 4
jmp 0x453438
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x453b20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4e7d04]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
call fcn.00453de0
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x453b4a
xor eax, eax
jmp 0x453be5
mov byte [ebp - 0x218], 0
push 0x207
push 0
lea ecx, [ebp - 0x217]
push ecx
call fcn.00482260
add esp, 0xc
push 0x208
push 0
lea edx, [ebp - 0x218]
push edx
call fcn.00482260
add esp, 0xc
mov dword [ebp - 8], 0
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x208
lea eax, [ebp - 0x218]
push eax
call fcn.0041a7a0
mov dword [ebp - 0x220], eax
push 0
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x218]
push edx
call fcn.00482ea0
add esp, 4
push eax
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004820d9
mov esp, ebp
pop ebp
ret

Function at 0x453de0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x4e7d04]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], ecx
mov eax, dword [ebp - 0x114]
cmp dword [eax], 0
je 0x453e09
jmp 0x453ed7
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea ecx, [ebp - 0x10f]
push ecx
call fcn.00482260
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x453e41
jmp 0x453ed7
push 0x104
push 0
mov eax, dword [ebp - 0x114]
add eax, 4
push eax
call fcn.00482260
add esp, 0xc
mov ecx, dword [ebp - 0x114]
add ecx, 4
push ecx
push 0
push 0x4c5800
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov eax, dword [ebp - 0x114]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str..bat
mov ecx, dword [ebp - 0x114]
add ecx, 4
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionA]
mov edx, dword [ebp - 0x114]
add edx, 4
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 4
push 0
push 7
push 0xc01200a0
mov eax, dword [ebp - 0x114]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp - 0x114]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004820d9
mov esp, ebp
pop ebp
ret
Function at 0x453ef0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x202c
call fcn.00484d50
mov eax, dword [0x4e7d04]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x453f11
xor eax, eax
jmp 0x453f90
push 0x1e
push 0
lea eax, [ebp - 0x202c]
push eax
call fcn.00482260
add esp, 0xc
mov dword [ebp - 0x200c], 0x1000
mov dword [ebp - 0x2028], 3
push 0x2000
push 0
lea ecx, [ebp - 0x2008]
push ecx
call fcn.00482260
add esp, 0xc
push 0x1000
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x2008]
push eax
call fcn.004856e8
add esp, 0xc
lea ecx, [ebp - 0x2008]
mov dword [ebp - 0x2024], ecx
mov edx, 0x614
mov word [ebp - 0x201c], dx
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004820d9
mov esp, ebp
pop ebp
ret
Function at 0x454510
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x454532
mov eax, 1
jmp 0x4545a1
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x454547
mov eax, 1
jmp 0x4545a1
push 0x80
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x45456f
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x45456f
mov eax, 1
jmp 0x4545a1
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x45459f
mov edx, dword [ebp - 8]
and edx, 0x10
je 0x45459f
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x45459f
mov eax, 1
jmp 0x4545a1
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4545b0
Capabilities:
Check if file exists
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4545e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x4c58a4
call fcn.00449630
add esp, 0xc
mov eax, 1
jmp 0x45464d
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4545fd
mov eax, 1
jmp 0x45464d
push 0x80
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x45463d
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x45463d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, dword [ebp + 8]
push edx
push str.delete__s_failed__error_d
call fcn.00449630
add esp, 0xc
mov eax, 1
jmp 0x45464d
push 4
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor eax, eax
mov esp, ebp
pop ebp
ret