joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447590
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, dword [edi + 0x90]
test ecx, ecx
je 0x4475b1
cmp ecx, 1
je 0x4475b1
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
push 0
push 0
push esi
push 0x4477c0
push 0
push 0
mov byte [esi + 0x7838], 1
call fcn.005f3cec
add esp, 0x18
mov dword [esi + 0x783c], eax
lea eax, [esi + 0x77e8]
mov ecx, edi
push eax
call fcn.00441d40
pop edi
mov byte [esi + 0x7838], 0
pop esi
pop ebp
ret 4
Function at 0x4475f0
Capabilities:
Check if file exists
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6e8dc0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x7cf070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
mov ecx, ebx
call fcn.004438c0
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x10]
test eax, eax
sete byte [ebp + 0xb]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x447651
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp + 0xb], 0
je 0x44766d
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [ebx + 0x30], 0
mov esi, 1
jne 0x447684
mov ecx, ebx
call fcn.00441c80
jmp 0x4477a0
mov ecx, str.OVYbbbbbl:DSV_kowx__5_ABKOS_eitty8
call fcn.0045f920
mov ecx, dword [edi + 0x5d0]
push eax
call fcn.004ad9d3
mov ecx, str.MNUWWWWWYds____9BQWmqrt_:_KO_fjvz_289
call fcn.0045f920
mov ecx, dword [edi + 0x628]
push eax
call fcn.004ad9d3
mov ecx, str.MNQTTTTT_dmqy_____6_DMYYkmv___79_JPhqu
call fcn.0045f920
mov ecx, dword [edi + 0x680]
push eax
call fcn.004ad9d3
lea eax, [ebx + 0xc]
mov ecx, str.KV_gggggguu_55AN_kouvz__6BMW_jt_4__KU
push eax
call fcn.0045f920
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00406410
mov esi, eax
mov ecx, str.NRWZZZZZ__jkt__0CMkz__0__MUhvw_7_MY
mov dword [ebp - 4], 0
call fcn.0045f920
push eax
lea eax, [ebp + 8]
push esi
push eax
call fcn.00404720
add esp, 0x18
mov byte [ebp - 4], 1
push dword [eax]
mov ecx, dword [edi + 0x520]
call fcn.004ad9d3
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov edx, dword [ebp + 8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x447731
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x447750
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, str.KW_bbbbbjp_12_CFKZdnww__9_N_ix.5_BKM
call fcn.0045f920
mov ecx, dword [edi + 0x6d8]
push eax
call fcn.004ad9d3
push 0
push 0
push edi
push 0x4477c0
push 0
push 0
mov byte [edi + 0x7838], 1
call fcn.005f3cec
add esp, 0x18
mov dword [edi + 0x783c], eax
lea eax, [edi + 0x77e8]
mov ecx, ebx
push eax
call fcn.00442590
mov esi, eax
mov byte [edi + 0x7838], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44c860
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ea008
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x7cf070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x10], 0
call fcn.004b08d6
mov ecx, eax
test ecx, ecx
jne 0x44c8a7
push 0x80004005
call fcn.00402890
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push 0
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push 0x400
push dword [ebp + 8]
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push dword [ebp - 0x10]
push esi
push edi
push ecx
mov ecx, str.BIJKKKKKR__jvy_55_BLUY_ddn__37_CKZ_ersuv_1__CIIOW_aehjp___IIUWWbnqy
call fcn.0045f920
add esp, 4
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00402960
add esp, 0x14
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x44c928
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44d460
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, ecx
test esi, esi
jne 0x44d46b
xor eax, eax
pop esi
ret
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x44d47d
mov eax, 1
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44d48d
test al, 0x10
jne 0x44d467
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
ret

Function at 0x44dc60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ea250
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push ebx
push esi
push edi
mov eax, dword [0x7cf070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x14], edi
mov eax, dword [ecx]
or ebx, 0xffffffff
sub eax, 0x10
push eax
call fcn.004050c0
add esp, 4
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov eax, dword [edi]
or edi, ebx
cmp dword [eax - 0xc], 0
je 0x44dd02
push dword [ebp - 0x14]
mov ecx, str.OST_my_2_FPY_js_5_FPhn.__IIM
call fcn.0045f920
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00406410
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.004071f0
mov byte [ebp - 4], 0
mov eax, edi
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44dcff
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x10]
push 0x40
lea eax, [ebp - 0x64]
xorps xmm0, xmm0
push 0
push eax
movups xmmword [ebp - 0x24], xmm0
call fcn.005ed880
add esp, 0xc
mov dword [ebp - 0x68], 0x44
cmp byte [0x7e8b58], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
jne 0x44dd4b
xor eax, eax
mov dword [ebp - 0x3c], 1
mov word [ebp - 0x38], ax
xor eax, eax
mov word [ebp - 0x36], ax
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x44ddae
push 0x493e0
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
mov ebx, 0xfffffffe
cmovne ebx, dword [ebp - 0x10]
call edi
push dword [ebp - 0x20]
call edi
or edi, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x44ddca
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44dfd0
Capabilities:
Check if file exists
Create directory
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ea2d0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x7cf070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
mov dword [ebp - 0x18], edi
push dword [edi]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call esi
test eax, eax
jne 0x44e022
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44e04a
test al, 0x10
je 0x44e04a
mov eax, 0xfffffffe
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebx]
call esi
mov edx, ebx
lea ecx, [ebp - 0x10]
call fcn.0044ecf0
mov dword [ebp - 4], 0
push dword [ebp - 0x10]
call esi
or edi, 0xffffffff
test eax, eax
jne 0x44e087
push eax
push dword [ebp - 0x10]
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push dword [ebp - 0x10]
call esi
test eax, eax
jne 0x44e087
lea ebx, [edi - 3]
jmp 0x44e16b
mov eax, dword [ebx]
sub eax, 0x10
push eax
call fcn.004050c0
add esp, 4
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 1
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44e140
test al, 0x10
je 0x44e140
mov ecx, str.N__ooooow__9BGOZber9BHHW_lx_4:_MMMOP_
call fcn.0045f920
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00404720
add esp, 0xc
mov esi, eax
mov ebx, dword [ebp - 0x18]
mov byte [ebp - 4], 2
push dword [ebx]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.00404720
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00405050
mov byte [ebp - 4], 2
mov eax, edi
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44e11d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov eax, edi
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44e13b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x14]
jmp 0x44e143
mov ebx, dword [ebp - 0x18]
push 1
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebx, eax
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov ecx, edi
lock xadd dword [esi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x44e16b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x44e18a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44e7b0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x7cf070]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push 0
push dword [ebp - 0x18]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e9199
mov esp, ebp
pop ebp
ret
Function at 0x44e830
Capabilities:
Check if file exists
Get file attributes
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ea368
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x7cf070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x1c], esi
push edi
mov dword [ebp - 0x20], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44e99f
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44e889
test al, 0x10
jne 0x44e99f
mov ecx, str.FNU_____jnot__.24_FGISY_fss_449CORTbkw_
call fcn.0045f920
push eax
lea ecx, [ebp - 0x10]
call fcn.00404e10
push 0
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0x14], eax
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004a5457
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x44e94c
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx*2 + 2]
push ecx
push 0
push ebx
call fcn.005ed880
add esp, 0xc
push ebx
push dword [ebp - 0x14]
push 0
push edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
mov ecx, str.CJLQQQQQZhioq__15CQ__jlw_5ALLT__doow__4
call fcn.0045f920
push eax
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x44e94c
movzx eax, word [ecx + 0x14]
push eax
movzx eax, word [ecx + 0x16]
push eax
movzx eax, word [ecx + 0x10]
push eax
movzx eax, word [ecx + 0x12]
mov ecx, str.NOSXXXXXet___9DIQVkw__37BBJVZZcett_7CJTYgr_._JV_o__17BPZfjqs___AO
push eax
call fcn.0045f920
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00402960
add esp, 0x18
push ebx
call fcn.004a5452
mov eax, dword [ebp - 0x10]
add esp, 4
add eax, 0xfffffff0
push eax
call fcn.004050c0
add eax, 0x10
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
add esp, 4
mov dword [esi], eax
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44e9b1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, str.AGKXXXXXep_____JXlouw_2:GUVdow__58_GL
call fcn.0045f920
push eax
mov ecx, esi
call fcn.00404e10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4517c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
mov eax, dword [edi]
call dword [eax + 4]
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x45187a
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x45187a
mov eax, edx
shr eax, 0x10
test eax, eax
jne 0x4517ed
movzx edx, dx
push ebx
push esi
mov esi, dword [ebp + 8]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x451871
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push esi
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x451871
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x451871
mov esi, dword [ebp + 0xc]
add esi, 0x10
push esi
call fcn.004a5457
push esi
push 0
push eax
mov dword [edi + 4], eax
call fcn.005ed880
mov eax, dword [ebp + 0xc]
push eax
push ebx
push dword [edi + 4]
mov dword [edi + 8], eax
call fcn.005ed9e0
add esp, 0x1c
mov dword [edi + 0xc], 0
mov dword [edi + 0x14], 1
mov eax, 1
mov dword [edi + 0x18], 0
pop esi
pop ebx
pop edi
pop ebp
ret 0xc
pop esi
pop ebx
xor eax, eax
pop edi
pop ebp
ret 0xc
xor eax, eax
pop edi
pop ebp
ret 0xc

Function at 0x452390
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [edx]
mov eax, 0xc6ef3720
push edi
mov edi, dword [edx + 4]
mov ebx, 0x20
mov dword [ebp - 4], ecx
nop dword [eax + eax]
mov edx, esi
mov ecx, esi
shl ecx, 4
dec ebx
shr edx, 5
xor edx, ecx
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 4]
mov ecx, eax
shr ecx, 0xb
add edx, esi
and ecx, 3
mov ecx, dword [ebx + ecx*4]
add ecx, eax
add eax, 0x61c88647
xor edx, ecx
sub edi, edx
mov edx, edi
mov ecx, edi
shl ecx, 4
shr edx, 5
xor edx, ecx
mov ecx, eax
and ecx, 3
add edx, edi
mov ecx, dword [ebx + ecx*4]
mov ebx, dword [ebp - 8]
add ecx, eax
xor edx, ecx
sub esi, edx
test ebx, ebx
jne 0x4523b0
mov eax, dword [ebp + 8]
mov dword [eax + 4], edi
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4549b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x1670]
sub eax, 1
je 0x4549dc
sub eax, 1
je 0x4549d4
sub eax, 1
jne 0x4549e8
mov eax, dword [esi + 0x12c4]
jmp 0x4549e2
mov eax, dword [esi + 0x117c]
jmp 0x4549e2
mov eax, dword [esi + 0x1034]
mov dword [esi + 0xf04], eax
cmp dword [esi + 0xf04], 0xffffffff
jne 0x454a1b
push 0xa
mov ecx, str.COPRRRRRaghnrtu___04_BFMNW_kqty_59:_FSajuy2_LMUVgmz3_FKX_jt_27LW_j
call fcn.0045f920
push ecx
mov ecx, esp
push eax
call fcn.00404e10
mov edx, 1
lea ecx, [edx + 0x1f]
call fcn.004243d0
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 3
mov dword [esi + 0x1870], 1
mov dword [esi + 0x80a4], 1
call fcn.00454aa0
push 0
push 0
push esi
push 0x456d60
push 0
push 0
call fcn.005f3cec
add esp, 0x18
mov dword [esi + 0x187c], eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x454a60
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push 0
push 3
mov dword [esi + 0x1870], 0
mov dword [esi + 0x80a4], 1
call fcn.00454aa0
push 0
push 0
push esi
push 0x456d60
push 0
push 0
call fcn.005f3cec
add esp, 0x18
mov dword [esi + 0x187c], eax
pop esi
ret
Function at 0x4589c0
Capabilities:
Check if file exists
Copy file
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6eafb6
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x7cf070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 0xc]
mov ecx, str.NNNPPPPPXagmw_4667DEFQVcenttt_48_GU_fj
mov esi, dword [ebp + 8]
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x220], eax
call fcn.0045f920
push eax
lea eax, [ebp - 0x224]
push 0x7e80d0
push eax
call fcn.00404720
lea ecx, [esi + 0x1c]
mov dword [ebp - 4], 0
push ecx
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.004047f0
add esp, 0x18
mov byte [ebp - 4], 2
or esi, 0xffffffff
mov edx, dword [ebp - 0x224]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x458a5d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x21c]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call edi
test eax, eax
jne 0x458ab1
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x21c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x458a91
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005e9199
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x220]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.005f42e8
mov eax, dword [ebp - 0x220]
add esp, 0xc
mov eax, dword [eax]
mov eax, dword [eax - 0xc]
add eax, eax
cmp eax, 0x208
jae 0x458b9c
xor ecx, ecx
mov word [ebp + eax - 0x218], cx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x458b18
push eax
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
je 0x458a6f
mov eax, dword [ebp - 0x228]
lea ecx, [ebx + 0x8098]
add eax, 0xc
mov dword [ebx + 0x8084], 1
push eax
call fcn.00405050
mov eax, dword [ebp - 0x220]
push 1
push 0
push ebx
push 0x4588d0
push dword [eax]
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x21c]
mov dword [ebx + 0x8084], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x458b92
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
jmp 0x458a93
call fcn.005e92f0
int3
Function at 0x459200
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6eb098
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x7cf070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 0x90]
test ecx, ecx
je 0x45924e
cmp ecx, 1
je 0x45924e
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, str.OWWeeeeenpqz__2_DOZhot4_CER_hiiiuz_4_
call fcn.0045f920
push eax
lea eax, [edi + 0xc]
push eax
lea eax, [ebp + 8]
push eax
call fcn.00404720
add esp, 0xc
mov dword [ebp - 4], 0
lea ecx, [esi + 0x1678]
push dword [eax]
call fcn.004ad9d3
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45929f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0
push 0
push esi
push 0x459420
push 0
push 0
mov byte [esi + 0x80f8], 1
call fcn.005f3cec
add esp, 0x18
mov dword [esi + 0x80fc], eax
lea eax, [esi + 0x80a8]
mov ecx, edi
push eax
call fcn.00441d40
mov byte [esi + 0x80f8], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4592f0
Capabilities:
Check if file exists
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6eb0c8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x7cf070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
call fcn.004438c0
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x10]
test eax, eax
sete bl
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45934e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x459368
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x30], 0
mov ebx, 1
jne 0x45937f
mov ecx, edi
call fcn.00441c80
jmp 0x45940a
mov ecx, str.L__kkkkkvz_34_EHRaakm__:_BBMX_abqsx_
call fcn.0045f920
push eax
lea eax, [edi + 0xc]
push eax
lea eax, [ebp + 8]
push eax
call fcn.00404720
add esp, 0xc
mov dword [ebp - 4], 0
lea ecx, [esi + 0x1678]
push dword [eax]
call fcn.004ad9d3
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4593d0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0
push 0
push esi
push 0x459420
push 0
push 0
mov byte [esi + 0x80f8], 1
call fcn.005f3cec
add esp, 0x18
mov dword [esi + 0x80fc], eax
lea eax, [esi + 0x80a8]
mov ecx, edi
push eax
call fcn.00442590
mov ebx, eax
mov byte [esi + 0x80f8], 0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4